login: Explicitly remount the container with MS_RDONLY
Turns out that even if the filesystem is mounted read-only outside the
container, the same mount inside the container will preserve the flag
that was passed explicitly (0, meaning read-write), even if the
underlying filesystem was marked read-only.
This change explicitly remounts the containers' rootfs with MS_RDONLY if
the underlying filesystem is mounted read-only.
BUG=b:31771616
TEST=FEATURES="test" emerge-${BOARD} chromeos-base/chromeos-login
TEST=test_that cheets_FileSystemPermission # passes
TEST=test_that cheets_FileSystemPermission # fails with WRITABLE_MOUNT=1
Change-Id: I1d715c22779226937546e0566dceb0de29501b60
Reviewed-on: https://chromium-review.googlesource.com/390412
Commit-Ready: Luis Hector Chavez <lhchavez@google.com>
Tested-by: Luis Hector Chavez <lhchavez@google.com>
Reviewed-by: Luis Hector Chavez <lhchavez@google.com>
(cherry picked from commit debfbb561c97861f211c877d9de233bd67d5a313)
Reviewed-on: https://chromium-review.googlesource.com/392348
Trybot-Ready: Luis Hector Chavez <lhchavez@google.com>
Reviewed-by: Dan Erat <derat@chromium.org>
Commit-Queue: Luis Hector Chavez <lhchavez@google.com>
4 files changed
