From 6f20a7c12ccec6bfc339dec4a7c43b870f923673 Mon Sep 17 00:00:00 2001 From: Nicolas Lacasse Date: Tue, 27 Sep 2022 14:52:03 -0700 Subject: [PATCH] Initialize MountNamespace before calling methods that depend on it. PiperOrigin-RevId: 477281632 --- pkg/sentry/control/lifecycle.go | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/pkg/sentry/control/lifecycle.go b/pkg/sentry/control/lifecycle.go index f4af623a7..8b3ae4448 100644 --- a/pkg/sentry/control/lifecycle.go +++ b/pkg/sentry/control/lifecycle.go @@ -249,6 +249,17 @@ func (l *Lifecycle) StartContainer(args *StartContainerArgs, _ *uint32) error { } initArgs.FDTable = fdTable + // VFS2 is supported in multi-container mode by default. + l.mu.RLock() + mntns, ok := l.MountNamespacesMap[initArgs.ContainerID] + if !ok { + l.mu.RUnlock() + return fmt.Errorf("mount namespace is nil for %s", initArgs.ContainerID) + } + initArgs.MountNamespaceVFS2 = mntns + l.mu.RUnlock() + initArgs.MountNamespaceVFS2.IncRef() + if args.ResolveBinaryPath { resolved, err := user.ResolveExecutablePath(ctx, &initArgs) if err != nil { @@ -265,17 +276,6 @@ func (l *Lifecycle) StartContainer(args *StartContainerArgs, _ *uint32) error { initArgs.Envv = envVars } - // VFS2 is supported in multi-container mode by default. - l.mu.RLock() - mntns, ok := l.MountNamespacesMap[initArgs.ContainerID] - if !ok { - l.mu.RUnlock() - return fmt.Errorf("mount namespace is nil for %s", initArgs.ContainerID) - } - initArgs.MountNamespaceVFS2 = mntns - l.mu.RUnlock() - initArgs.MountNamespaceVFS2.IncRef() - fds, err := fd.NewFromFiles(args.Files) if err != nil { return fmt.Errorf("duplicating payload files: %w", err)