netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

Add more justification about why shared mount propagation is not allowed.

Browse Source 
Updates #9324

PiperOrigin-RevId: 563208592
This commit is contained in:
Ayush Ranjan
2023-09-06 14:06:31 -07:00
committed by gVisor bot
parent 4146284b60
commit 8aee177900
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
runsc/specutils/fs.go
+3 -1
View File
@@ -79,7 +79,9 @@ var propOptionsMap = map[string]mapping{
// invalidOptions list options not allowed.
// - shared: sandbox must be isolated from the host. Propagating mount changes
// from the sandbox to the host breaks the isolation.
// from the sandbox to the host breaks the isolation. The sandbox's mount
// table is maintained in sentry memory. Mount operations from the application
// are not propagated to the host.
var invalidOptions = []string{"shared", "rshared"}
// OptionsToFlags converts mount options to syscall flags.