1
Fork 0
mirror of https://https.git.savannah.gnu.org/git/guix.git/ synced 2025-07-10 08:30:39 +02:00
guix/gnu/build
Ludovic Courtès a57ed987ff
linux-container: Lock mounts by default.
This makes it impossible to unmount or remount things from within
‘call-with-container’.

* gnu/build/linux-container.scm (initialize-user-namespace):
Add #:host-uid and #:host-gid. and honor them.
(run-container): Add #:lock-mounts?.  Honor it by calling ‘unshare’
followed by ‘initialize-user-namespace’.
(call-with-container): Add #:lock-mounts? and pass it down.
(container-excursion): Get the user namespace owning the PID namespace
and join it, then join the remaining namespaces.
* tests/containers.scm ("call-with-container, mnt namespace, locked mounts"):
New test.
("container-excursion"): Pass #:lock-mounts? #f.

Change-Id: I13be982aef99e68a653d472f0e595c81cfcfa392
2025-05-05 14:34:00 +02:00
..
accounts.scm accounts: Add /etc/subid and /etc/subgid allocation logic. 2024-12-18 18:32:40 +01:00
activation.scm activation: Fix ‘mkdir-p/perms’ on the Hurd. 2025-04-23 12:25:45 +02:00
bootloader.scm build: bootloader: Add riscv64 case. 2025-04-08 14:58:19 +08:00
chromium-extension.scm chromium-extension: Compute json at argument evaluation time. 2023-12-27 17:18:52 +01:00
cross-toolchain.scm gnu: cross-toolchain: Add set-cross-path for AVR. 2023-12-11 13:36:51 +02:00
dbus-service.scm build: dbus-service: Quote body argument in 'with-retries' syntax. 2025-04-14 10:34:52 +09:00
file-systems.scm bootloader: grub: Remove hardcoded partition number for the Hurd. 2024-11-11 07:28:33 +01:00
hurd-boot.scm hurd-boot: Support second boot. 2024-11-11 07:28:33 +01:00
icecat-extension.scm gnu: ‘make-icecat-extension’ inherits package location. 2023-12-10 21:46:52 +01:00
image.scm image: Create zstd-compressed qcow2 images. 2025-04-30 17:14:24 +09:00
install.scm services: activation: Ensure /run existence. 2024-02-19 18:42:12 +01:00
jami-service.scm
linux-boot.scm linux-boot: Don't create /root before it's used. 2023-11-19 01:00:00 +01:00
linux-container.scm linux-container: Lock mounts by default. 2025-05-05 14:34:00 +02:00
linux-initrd.scm
linux-modules.scm gnu: linux-libre: Enable Zstd compression of kernel modules. 2024-05-29 22:01:23 -04:00
locale.scm
marionette.scm build: marionette: Make it possible to reboot VM during tests. 2025-02-13 00:07:21 +09:00
secret-service.scm services: secret-service: Make the endpoint configurable. 2024-02-10 22:59:43 +01:00
shepherd.scm shepherd: Remove ‘make-forkexec-constructor/container’. 2023-12-22 00:31:42 +01:00
svg.scm