runsc: support /dev bind mount which does not conflict with default /dev mount.

PiperOrigin-RevId: 200768923
Change-Id: I4b8da10bcac296e8171fe6754abec5aabfec5e65

1 files changed, 26 insertions, 33 deletions

diff --git a/runsc/boot/fs.go b/runsc/boot/fs.go
index 3113f1857..7786e4d4a 100644
--- a/runsc/boot/fs.go
+++ b/runsc/boot/fs.go
@@ -35,6 +35,7 @@ import (
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/ramfs"
 	"gvisor.googlesource.com/gvisor/pkg/syserror"
+	"gvisor.googlesource.com/gvisor/runsc/specutils"
 )
 
 type fdDispenser struct {
@@ -78,16 +79,29 @@ func configureMounts(ctx context.Context, spec *specs.Spec, conf *Config, mns *f
 	// Keep track of whether proc, sys, and tmp were mounted.
 	var procMounted, sysMounted, tmpMounted bool
 
+	// Always mount /dev.
+	if err := mountSubmount(ctx, spec, conf, mns, nil, specs.Mount{
+		Type:        "devtmpfs",
+		Destination: "/dev",
+	}); err != nil {
+		return err
+	}
+
+	// Always mount /dev/pts.
+	if err := mountSubmount(ctx, spec, conf, mns, nil, specs.Mount{
+		Type:        "devpts",
+		Destination: "/dev/pts",
+	}); err != nil {
+		return err
+	}
+
 	// Mount all submounts from the spec.
 	for _, m := range spec.Mounts {
-		// OCI spec uses many different mounts for the things inside of '/dev'. We
-		// have a single mount at '/dev' that is always mounted, regardless of
-		// whether it was asked for, as the spec says we SHOULD.
-		if strings.HasPrefix(m.Destination, "/dev") {
+		if !specutils.IsSupportedDevMount(m) {
 			log.Warningf("ignoring dev mount at %q", m.Destination)
 			continue
 		}
-		switch m.Destination {
+		switch filepath.Clean(m.Destination) {
 		case "/proc":
 			procMounted = true
 		case "/sys":
@@ -101,22 +115,6 @@ func configureMounts(ctx context.Context, spec *specs.Spec, conf *Config, mns *f
 		}
 	}
 
-	// Always mount /dev.
-	if err := mountSubmount(ctx, spec, conf, mns, nil, specs.Mount{
-		Type:        "devtmpfs",
-		Destination: "/dev",
-	}); err != nil {
-		return err
-	}
-
-	// Always mount /dev/pts.
-	if err := mountSubmount(ctx, spec, conf, mns, nil, specs.Mount{
-		Type:        "devpts",
-		Destination: "/dev/pts",
-	}); err != nil {
-		return err
-	}
-
 	// Mount proc and sys even if the user did not ask for it, as the spec
 	// says we SHOULD.
 	if !procMounted {
@@ -282,18 +280,13 @@ func mountSubmount(ctx context.Context, spec *specs.Spec, conf *Config, mns *fs.
 
 	// If there are submounts, we need to overlay the mount on top of a
 	// ramfs with stub directories for submount paths.
-	//
-	// We do not do this for /dev, since there will usually be submounts in
-	// the spec, but our devfs implementation contains all the necessary
-	// directories and files (well, most of them anyways).
-	if m.Destination != "/dev" {
-		submounts := subtargets(m.Destination, spec.Mounts)
-		if len(submounts) > 0 {
-			log.Infof("Adding submount overlay over %q", m.Destination)
-			inode, err = addSubmountOverlay(ctx, inode, submounts)
-			if err != nil {
-				return fmt.Errorf("error adding submount overlay: %v", err)
-			}
+	mounts := specutils.SupportedMounts(spec.Mounts)
+	submounts := subtargets(m.Destination, mounts)
+	if len(submounts) > 0 {
+		log.Infof("Adding submount overlay over %q", m.Destination)
+		inode, err = addSubmountOverlay(ctx, inode, submounts)
+		if err != nil {
+			return fmt.Errorf("error adding submount overlay: %v", err)
 		}
 	}