From 2f3b309f37b3a8bfeaccf54ac1b0740a849a8b6f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ludovic=20Court=C3=A8s?= Date: Tue, 14 Jan 2025 17:58:12 +0100 Subject: [PATCH] linux-container: Ignore EPERM when attempting to mount /sys. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fixes . Until now, this would work: guix shell --no-cwd -CWP -- guix shell -C coreutils -- ls -R /home … but this would not: $ guix shell --no-cwd -CWPN -- guix shell -C coreutils -- ls -R /home guix shell: error: mount: mount "none" on "/tmp/guix-directory.Wnc2OI/sys": Operation not permitted This is annoying and hardly understandable. Since we already disable /sys mounts when sharing the global network namespace is asked (as in ‘guix shell -CN‘), for the very same reason, we can just as well disable /sys mounts anytime it fails with EPERM. * gnu/build/linux-container.scm (mount-file-systems): Silently ignore EPERM when attempting to mount /sys. Change-Id: If85b1d703ab58a98ea9873f4f8fed71a06b7aa63 --- gnu/build/linux-container.scm | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/gnu/build/linux-container.scm b/gnu/build/linux-container.scm index dee6885400..5c303da8c8 100644 --- a/gnu/build/linux-container.scm +++ b/gnu/build/linux-container.scm @@ -109,8 +109,14 @@ for the process." ;; A sysfs mount requires the user to have the CAP_SYS_ADMIN capability in ;; the current network namespace. (when mount-/sys? - (mount* "none" (scope "/sys") "sysfs" - (logior MS_NOEXEC MS_NOSUID MS_NODEV MS_RDONLY))) + (catch 'system-error + (lambda () + (mount* "none" (scope "/sys") "sysfs" + (logior MS_NOEXEC MS_NOSUID MS_NODEV MS_RDONLY))) + (lambda args + ;; EPERM means that CAP_SYS_ADMIN is missing. Ignore. + (unless (= EPERM (system-error-errno args)) + (apply throw args))))) (mount* "none" (scope "/dev") "tmpfs" (logior MS_NOEXEC MS_STRICTATIME)