@@ -334,7 +334,7 @@ pub(crate) struct SourceInfo {
334334 /// The digest to use for pulls
335335pub ( crate ) digest : Option < String > ,
336336 /// Whether or not SELinux appears to be enabled in the source commit
337- pub ( crate ) selinux : bool ,
337+ pub ( crate ) _selinux : bool ,
338338 /// Whether the source is available in the host mount namespace
339339pub ( crate ) in_host_mountns : bool ,
340340}
@@ -585,7 +585,7 @@ impl SourceInfo {
585585 Ok ( Self {
586586 imageref,
587587 digest,
588- selinux,
588+ _selinux : selinux,
589589 in_host_mountns,
590590 } )
591591 }
@@ -946,7 +946,7 @@ pub(crate) fn reexecute_self_for_selinux_if_needed(
946946 override_disable_selinux : bool ,
947947) -> Result < SELinuxFinalState > {
948948 // If the target state has SELinux enabled, we need to check the host state.
949- if srcdata . selinux {
949+ if false {
950950 let host_selinux = crate :: lsm:: selinux_enabled ( ) ?;
951951 tracing:: debug!( "Target has SELinux, host={host_selinux}" ) ;
952952 let r = if override_disable_selinux {
@@ -1031,66 +1031,6 @@ fn ensure_var() -> Result<()> {
10311031 Ok ( ( ) )
10321032}
10331033
1034- /// We want to have proper /tmp and /var/tmp without requiring the caller to set them up
1035- /// in advance by manually specifying them via `podman run -v /tmp:/tmp` etc.
1036- /// Unfortunately, it's quite complex right now to "gracefully" dynamically reconfigure
1037- /// the mount setup for a container. See https://brauner.io/2023/02/28/mounting-into-mount-namespaces.html
1038- /// So the brutal hack we do here is to rely on the fact that we're running in the host
1039- /// pid namespace, and so the magic link for /proc/1/root will escape our mount namespace.
1040- /// We can't bind mount though - we need to symlink it so that each calling process
1041- /// will traverse the link.
1042- #[ context( "Linking tmp mounts to host" ) ]
1043- pub ( crate ) fn setup_tmp_mounts ( ) -> Result < ( ) > {
1044- let st = rustix:: fs:: statfs ( "/tmp" ) ?;
1045- if st. f_type == libc:: TMPFS_MAGIC {
1046- tracing:: trace!( "Already have tmpfs /tmp" )
1047- } else {
1048- // Note we explicitly also don't want a "nosuid" tmp, because that
1049- // suppresses our install_t transition
1050- Task :: new ( "Mounting tmpfs /tmp" , "mount" )
1051- . args ( [ "tmpfs" , "-t" , "tmpfs" , "/tmp" ] )
1052- . quiet ( )
1053- . run ( ) ?;
1054- }
1055-
1056- // Point our /var/tmp at the host, via the /proc/1/root magic link
1057- for path in [ "/var/tmp" ] . map ( Utf8Path :: new) {
1058- if path. try_exists ( ) ? {
1059- let st = rustix:: fs:: statfs ( path. as_std_path ( ) ) . context ( path) ?;
1060- if st. f_type != libc:: OVERLAYFS_SUPER_MAGIC {
1061- tracing:: trace!( "Already have {path} with f_type={}" , st. f_type) ;
1062- continue ;
1063- }
1064- }
1065- let target = format ! ( "/proc/1/root/{path}" ) ;
1066- let tmp = format ! ( "{path}.tmp" ) ;
1067- // Ensure idempotence in case we're re-executed
1068- if path. is_symlink ( ) {
1069- continue ;
1070- }
1071- tracing:: debug!( "Retargeting {path} to host" ) ;
1072- if path. try_exists ( ) ? {
1073- std:: os:: unix:: fs:: symlink ( & target, & tmp)
1074- . with_context ( || format ! ( "Symlinking {target} to {tmp}" ) ) ?;
1075- let cwd = rustix:: fs:: CWD ;
1076- rustix:: fs:: renameat_with (
1077- cwd,
1078- path. as_os_str ( ) ,
1079- cwd,
1080- & tmp,
1081- rustix:: fs:: RenameFlags :: EXCHANGE ,
1082- )
1083- . with_context ( || format ! ( "Exchanging {path} <=> {tmp}" ) ) ?;
1084- std:: fs:: rename ( & tmp, format ! ( "{path}.old" ) )
1085- . with_context ( || format ! ( "Renaming old {tmp}" ) ) ?;
1086- } else {
1087- std:: os:: unix:: fs:: symlink ( & target, path)
1088- . with_context ( || format ! ( "Symlinking {target} to {path}" ) ) ?;
1089- } ;
1090- }
1091- Ok ( ( ) )
1092- }
1093-
10941034/// By default, podman/docker etc. when passed `--privileged` mount `/sys` as read-only,
10951035/// but non-recursively. We selectively grab sub-filesystems that we need.
10961036#[ context( "Ensuring sys mount {fspath} {fstype}" ) ]
@@ -1222,7 +1162,7 @@ async fn prepare_install(
12221162 crate :: mount:: ensure_mirrored_host_mount ( "/dev" ) ?;
12231163 crate :: mount:: ensure_mirrored_host_mount ( "/var/lib/containers" ) ?;
12241164 ensure_var ( ) ?;
1225- setup_tmp_mounts ( ) ?;
1165+ // setup_tmp_mounts()?;
12261166 // Allocate a temporary directory we can use in various places to avoid
12271167 // creating multiple.
12281168 let tempdir = cap_std_ext:: cap_tempfile:: TempDir :: new ( cap_std:: ambient_authority ( ) ) ?;
0 commit comments