Don't bind-mount runsc into a sandbox mntns

PiperOrigin-RevId: 230437407
Change-Id: Id9d8ceeb018aad2fe317407c78c6ee0f4b47aa2b

4 files changed, 5 insertions, 19 deletions

diff --git a/runsc/cmd/boot.go b/runsc/cmd/boot.go
index 7f87b2623..3039b389f 100644
--- a/runsc/cmd/boot.go
+++ b/runsc/cmd/boot.go
@@ -129,7 +129,6 @@ func (b *Boot) Execute(_ context.Context, f *flag.FlagSet, args ...interface{})
 			Fatalf("error setting up chroot: %v", err)
 		}
 
-		specutils.ExePath = "/runsc"
 		if !b.applyCaps {
 			// Remove --setup-root arg to call myself.
 			var args []string
diff --git a/runsc/cmd/chroot.go b/runsc/cmd/chroot.go
index ec539a11c..c1acbf26b 100644
--- a/runsc/cmd/chroot.go
+++ b/runsc/cmd/chroot.go
@@ -24,10 +24,6 @@ import (
 	"gvisor.googlesource.com/gvisor/runsc/specutils"
 )
 
-// chrootBinPath is the location inside the chroot where the runsc binary will
-// be mounted.
-const chrootBinPath = "/runsc"
-
 // mountInChroot creates the destination mount point in the given chroot and
 // mounts the source.
 func mountInChroot(chroot, src, dst, typ string, flags uint32) error {
@@ -70,10 +66,6 @@ func setUpChroot(pidns bool) error {
 		}
 	}
 
-	if err := mountInChroot(chroot, specutils.ExePath, chrootBinPath, "bind", syscall.MS_BIND|syscall.MS_RDONLY); err != nil {
-		return fmt.Errorf("error mounting runsc in chroot: %v", err)
-	}
-
 	if err := os.Chdir(chroot); err != nil {
 		return fmt.Errorf("error changing working directory: %v", err)
 	}
diff --git a/runsc/cmd/cmd.go b/runsc/cmd/cmd.go
index fbfc18fc9..208cf5304 100644
--- a/runsc/cmd/cmd.go
+++ b/runsc/cmd/cmd.go
@@ -80,13 +80,10 @@ func setCapsAndCallSelf(args []string, caps *specs.LinuxCapabilities) error {
 	if err := applyCaps(caps); err != nil {
 		return fmt.Errorf("applyCaps() failed: %v", err)
 	}
-	binPath, err := specutils.BinPath()
-	if err != nil {
-		return err
-	}
+	binPath := specutils.ExePath
 
 	log.Infof("Execve %q again, bye!", binPath)
-	err = syscall.Exec(binPath, args, []string{})
+	err := syscall.Exec(binPath, args, []string{})
 	return fmt.Errorf("error executing %s: %v", binPath, err)
 }
 
@@ -105,7 +102,7 @@ func callSelfAsNobody(args []string) error {
 		return fmt.Errorf("error setting gid: %v", err)
 	}
 
-	binPath := "/runsc"
+	binPath := specutils.ExePath
 
 	log.Infof("Execve %q again, bye!", binPath)
 	err := syscall.Exec(binPath, args, []string{})
diff --git a/runsc/cmd/exec.go b/runsc/cmd/exec.go
index 13584d800..9e058ad97 100644
--- a/runsc/cmd/exec.go
+++ b/runsc/cmd/exec.go
@@ -186,10 +186,7 @@ func (ex *Exec) Execute(_ context.Context, f *flag.FlagSet, args ...interface{})
 }
 
 func (ex *Exec) execAndWait(waitStatus *syscall.WaitStatus) subcommands.ExitStatus {
-	binPath, err := specutils.BinPath()
-	if err != nil {
-		Fatalf("getting bin path: %v", err)
-	}
+	binPath := specutils.ExePath
 	var args []string
 
 	// The command needs to write a pid file so that execAndWait can tell
@@ -219,6 +216,7 @@ func (ex *Exec) execAndWait(waitStatus *syscall.WaitStatus) subcommands.ExitStat
 	}
 
 	cmd := exec.Command(binPath, args...)
+	cmd.Args[0] = "runsc-exec"
 
 	// Exec stdio defaults to current process stdio.
 	cmd.Stdin = os.Stdin