containers / containers/bubblewrap
`--bind` can cause bwrap to fail during startup if it races with the mount table changing
- Dominant language
- C
- Stars
- 8.7k
- Forks
- 386
- Avg merge
- 3d 17h
- Merged PRs (30d)
- 11
Description
Try running this in one terminal to cause the mount table to change frequently:
```
$ mkdir from to
$ while true; do sudo mount --bind from to && sudo umount to; done
```
And run bwrap repeatedly in another terminal:
```
$ while true; do bwrap --bind / / -- /bin/true && echo -n .; done
...................................................................................................bwrap: Can't bind mount /oldroot/ on /newroot/: Unable to apply mount flags: remount "/newroot//to": Invalid argument
.....................................................................................................................................................................................................................................................................................................................................bwrap: Can't bind mount /oldroot/ on /newroot/: Unable to apply mount flags: remount "/newroot//to": Invalid argument
..............................................................................................................................................................................................................................................................................................................................................................................................................bwrap: Can't bind mount /oldroot/ on /newroot/: Unable to apply mount flags: remount "/newroot//to": Invalid argument
.....................................
```
This likely happens because the `bind_mount` function grabs the current mount table (https://github.com/containers/bubblewrap/blob/973fe36146a261fb7711217719c54c77d2d0139b/bind-mount.c#L438) and then remounts its entries one by one to ensure `--bind` works recursively but fails if any of the sub-mounts fail (https://github.com/containers/bubblewrap/blob/973fe36146a261fb7711217719c54c77d2d0139b/bind-mount.c#L472). The implicit assumption is that any mount that's already listed in the mount table is going to stay there and so we should be able to remount it, but mounts can definitely disappear in real-world scenarios (e.g. if the user unmounts something manually or if autofs is used with non-zero timeouts), so bwrap should be robust to that.
It already checks that `errno != EACCES`; perhaps this failure can be excluded in the same way.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.