support recursive read only (rro) option for mounts

libpod/container_internal_common.go

@@ -374,6 +374,27 @@ func (c *Container) generateSpec(ctx context.Context) (s *spec.Spec, cleanupFunc
 				// Podman decided for --no-dereference as many
 				// bin-utils tools (e..g, touch, chown, cp) do.
 				options = append(options, "copy-symlink")
+			// TODO: this also ends up checking non-user mounts
+			case "ro", "rro":
+				// There are 2 cases:
+				// 1. User requests `rro`
+				// 		* Return error if runtime does not support `rro`
+				// 2. User requests `ro`
+				// 		* Use `rro` if runtime supports `rro`
+				// 		* Use `ro` if runtime does not support `rro`
+				rro := true
+				if err := util.SupportsRecursiveReadonly(c.ociRuntime.Features()); err != nil {
+					rro = false
+					if o == "rro" {
+						return nil, nil, err
+					}
+				}
+
+				if rro {
+					options = append(options, "rro")
+				} else {
+					options = append(options, "ro")
+				}
 			default:
 				options = append(options, o)
 			}

libpod/oci.go

@@ -8,6 +8,7 @@ import (
 	"github.com/containers/common/pkg/resize"
 	"github.com/containers/podman/v5/libpod/define"
 	"github.com/opencontainers/runtime-spec/specs-go"
+	"github.com/opencontainers/runtime-spec/specs-go/features"
 )
 
 // OCIRuntime is an implementation of an OCI runtime.
@@ -131,6 +132,9 @@ type OCIRuntime interface { //nolint:interfacebloat
 	// without KVM separation
 	SupportsKVM() bool
 
+	// Features returns the features struct from the OCI runtime
+	Features() *features.Features
+
 	// AttachSocketPath is the path to the socket to attach to a given
 	// container.
 	// TODO: If we move Attach code in here, this should be made internal.

libpod/oci_conmon_common.go

@@ -36,6 +36,7 @@ import (
 	"github.com/containers/podman/v5/utils"
 	"github.com/containers/storage/pkg/idtools"
 	spec "github.com/opencontainers/runtime-spec/specs-go"
+	"github.com/opencontainers/runtime-spec/specs-go/features"
 	"github.com/sirupsen/logrus"
 	"golang.org/x/sys/unix"
 )
@@ -66,6 +67,7 @@ type ConmonOCIRuntime struct {
 	supportsNoCgroups bool
 	enableKeyring     bool
 	persistDir        string
+	features          *features.Features
 }
 
 // Make a new Conmon-based OCI runtime with the given options.
@@ -131,6 +133,12 @@ func newConmonOCIRuntime(name string, paths []string, conmonPath string, runtime
 		break
 	}
 
+	features, err := runtime.getOCIRuntimeFeatures()
+	if err != nil {
+		return nil, fmt.Errorf("getting %s features: %w", runtime.name, err)
+	}
+	runtime.features = features
+
 	// Search the $PATH as last fallback
 	if !foundPath {
 		if foundRuntime, err := exec.LookPath(name); err == nil {
@@ -839,6 +847,11 @@ func (r *ConmonOCIRuntime) SupportsKVM() bool {
 	return r.supportsKVM
 }
 
+// Features returns the features struct from the OCI runtime
+func (r *ConmonOCIRuntime) Features() *features.Features {
+	return r.features
+}
+
 // AttachSocketPath is the path to a single container's attach socket.
 func (r *ConmonOCIRuntime) AttachSocketPath(ctr *Container) (string, error) {
 	if ctr == nil {
@@ -1485,6 +1498,20 @@ func (r *ConmonOCIRuntime) getConmonVersion() (string, error) {
 	return strings.TrimSuffix(strings.Replace(output, "\n", ", ", 1), "\n"), nil
 }
 
+func (r *ConmonOCIRuntime) getOCIRuntimeFeatures() (*features.Features, error) {
+	var features *features.Features
+	output, err := utils.ExecCmd(r.path, "features")
+	if err != nil {
+		return features, err
+	}
+
+	if jsonErr := json.Unmarshal([]byte(output), &features); jsonErr != nil {
+		return features, err
+	}
+
+	return features, nil
+}
+
 // getOCIRuntimeVersion returns a string representation of the OCI runtime's
 // version.
 func (r *ConmonOCIRuntime) getOCIRuntimeVersion() (string, error) {

libpod/oci_missing.go

@@ -11,6 +11,7 @@ import (
 	"github.com/containers/common/pkg/resize"
 	"github.com/containers/podman/v5/libpod/define"
 	spec "github.com/opencontainers/runtime-spec/specs-go"
+	"github.com/opencontainers/runtime-spec/specs-go/features"
 	"github.com/sirupsen/logrus"
 )
 
@@ -194,6 +195,11 @@ func (r *MissingRuntime) SupportsKVM() bool {
 	return false
 }
 
+// Features returns nil since this is a missing runtime
+func (r *MissingRuntime) Features() *features.Features {
+	return nil
+}
+
 // AttachSocketPath does not work as there is no runtime to attach to.
 // (Theoretically we could follow ExitFilePath but there is no guarantee the
 // container is running and thus has an attach socket...)

pkg/specgen/volumes.go

@@ -43,8 +43,7 @@ type OverlayVolume struct {
 }
 
 // ImageVolume is a volume based on a container image.  The container image is
-// first mounted on the host and is then bind-mounted into the container.  An
-// ImageVolume is always mounted read-only.
+// first mounted on the host and is then bind-mounted into the container.
 type ImageVolume struct {
 	// Source is the source of the image volume.  The image can be referred
 	// to by name and by ID.

pkg/specgenutil/volumes.go

@@ -345,34 +345,38 @@ func parseMountOptions(mountType string, args []string) (*universalMount, error)
 			} else {
 				mnt.mount.Options = append(mnt.mount.Options, "idmap")
 			}
-		case "readonly", "ro", "rw":
+		case "readonly", "ro", "recursivereadonly", "rro", "rw":
 			if setRORW {
-				return nil, fmt.Errorf("cannot pass 'readonly', 'ro', or 'rw' mnt.Options more than once: %w", errOptionArg)
+				return nil, fmt.Errorf("cannot pass 'readonly', 'ro', 'rro', 'recursivereadonly' or 'rw' options more than once: %w", errOptionArg)
 			}
 			setRORW = true
+
 			// Can be formatted as one of:
 			// readonly
 			// readonly=[true|false]
 			// ro
 			// ro=[true|false]
+			// recursivereadonly
+			// recursivereadonly=[true|false]
+			// rro
+			// rro=[true|false]
 			// rw
 			// rw=[true|false]
-			if name == "readonly" {
-				name = "ro"
-			}
-			if hasValue {
-				switch strings.ToLower(value) {
-				case "true":
-					mnt.mount.Options = append(mnt.mount.Options, name)
-				case "false":
-					// Set the opposite only for rw
-					// ro's opposite is the default
-					if name == "rw" {
-						mnt.mount.Options = append(mnt.mount.Options, "ro")
+			switch name {
+			case "rro", "recursivereadonly":
+				mnt.mount.Options = append(mnt.mount.Options, "rro")
+			case "ro", "readonly":
+				mnt.mount.Options = append(mnt.mount.Options, "ro")
+			case "rw":
+				if hasValue {
+					switch strings.ToLower(value) {
+					case "true":
+						mnt.mount.Options = append(mnt.mount.Options, name)
+					case "false":
+						// default to rro instead of ro
+						mnt.mount.Options = append(mnt.mount.Options, "rro")
 					}
 				}
-			} else {
-				mnt.mount.Options = append(mnt.mount.Options, name)
 			}
 		case "nodev", "dev":
 			if setDev {

pkg/util/mount_opts.go

@@ -94,7 +94,7 @@ func processOptionsInternal(options []string, isTmpfs bool, sourcePath string, g
 				return nil, fmt.Errorf("only one of 'nodev' and 'dev' can be used: %w", ErrDupeMntOption)
 			}
 			foundDev = true
-		case "rw", "ro":
+		case "rw", "ro", "rro":
 			if foundWrite {
 				return nil, fmt.Errorf("only one of 'rw' and 'ro' can be used: %w", ErrDupeMntOption)
 			}

pkg/util/utils_linux.go

@@ -6,21 +6,28 @@ import (
 	"io/fs"
 	"os"
 	"path/filepath"
+	"slices"
 	"strconv"
 	"strings"
+	"sync"
 	"syscall"
 
 	"github.com/containers/podman/v5/libpod/define"
 	"github.com/containers/podman/v5/pkg/rootless"
 	"github.com/containers/psgo"
 	spec "github.com/opencontainers/runtime-spec/specs-go"
+	"github.com/opencontainers/runtime-spec/specs-go/features"
 	"github.com/opencontainers/runtime-tools/generate"
 	"github.com/sirupsen/logrus"
 	"golang.org/x/sys/unix"
 )
 
 var (
-	errNotADevice = errors.New("not a device node")
+	errNotADevice               = errors.New("not a device node")
+	errKernelDoesNotSupportRRO  = errors.New("kernel does not support recursive readonly mount option `rro`")
+	errRuntimeDoesNotSupportRRO = errors.New("runtime does not support recursive readonly mount option `rro`")
+
+	kernelSupportsRROOnce sync.Once
 )
 
 // GetContainerPidInformationDescriptors returns a string slice of all supported
@@ -258,3 +265,70 @@ func DeviceFromPath(path string) (*spec.LinuxDevice, error) {
 		Minor:    int64(unix.Minor(devNumber)),
 	}, nil
 }
+
+// kernelSupportsRecursivelyReadOnly returns true if the kernel supports recursive readonly mounts
+// from https://github.com/moby/moby/blob/master/daemon/daemon_linux.go#L222
+func kernelSupportsRecursivelyReadOnly() error {
+	fn := func() error {
+		tmpMnt, err := os.MkdirTemp("", "podman-detect-rro")
+		if err != nil {
+			return fmt.Errorf("failed to create a temp directory: %w", err)
+		}
+		for {
+			err = unix.Mount("", tmpMnt, "tmpfs", 0, "")
+			if !errors.Is(err, unix.EINTR) {
+				break
+			}
+		}
+		if err != nil {
+			return fmt.Errorf("failed to mount tmpfs on %q: %w", tmpMnt, err)
+		}
+		defer func() {
+			var umErr error
+			for {
+				umErr = unix.Unmount(tmpMnt, 0)
+				if !errors.Is(umErr, unix.EINTR) {
+					break
+				}
+			}
+			if umErr != nil {
+				logrus.Errorf("Failed to unmount %q: %v", tmpMnt, umErr)
+			}
+		}()
+		attr := &unix.MountAttr{
+			Attr_set: unix.MOUNT_ATTR_RDONLY,
+		}
+		for {
+			err = unix.MountSetattr(-1, tmpMnt, unix.AT_RECURSIVE, attr)
+			if !errors.Is(err, unix.EINTR) {
+				break
+			}
+		}
+		// ENOSYS on kernel < 5.12
+		if err != nil {
+			return fmt.Errorf("failed to call mount_setattr with AT_RECURSIVE: %w", err)
+		}
+		return nil
+	}
+
+	kernelSupportsRROOnce.Do(func() {
+		errKernelDoesNotSupportRRO = fn()
+	})
+	return errKernelDoesNotSupportRRO
+}
+
+// SupportsRecursiveReadonly returns true if the runtime supports recursive readonly mounts
+func SupportsRecursiveReadonly(features *features.Features) error {
+	if err := kernelSupportsRecursivelyReadOnly(); err != nil {
+		return err
+	}
+
+	if features == nil || features.MountOptions == nil {
+		return errRuntimeDoesNotSupportRRO
+	}
+	if !slices.Contains(features.MountOptions, "rro") {
+		return errRuntimeDoesNotSupportRRO
+	}
+
+	return nil
+}

test/system/060-mount.bats

@@ -573,3 +573,28 @@ glob | /*    | /mountroot/           | in
 
     run_podman rmi -f $img
 }
+
+# bats test_tags=ci:parallel
+@test "podman bind mount rro" {
+    skip_if_rootless
+
+    volName="vol-$(safename)"
+    volPath=${PODMAN_TMPDIR}/$volName
+    mkdir -p $volPath
+
+    mount -t tmpfs tmpfs $volPath
+    mkdir -p $volPath/foo $volPath/bar
+    mount -t tmpfs tmpfs $volPath/foo
+    mount -t tmpfs tmpfs $volPath/bar
+
+    run_podman 1 run --rm -it -v $volPath/:/tmp/mounts:rro $IMAGE touch /tmp/mounts/foo/test
+    assert "$output" =~ "Read-only file system" "Error should indicate read-only filesystem"
+
+    run_podman 1 run --rm -it --mount type=bind,source=$volPath,destination=/tmp/mounts,recursivereadonly=true $IMAGE touch /tmp/mounts/bar/test
+    assert "$output" =~ "Read-only file system" "Error should indicate read-only filesystem"
+
+    umount $volPath/foo
+    umount $volPath/bar
+    umount $volPath
+    rm -rf $volPath
+}