fix #1451: allow one to add mount options to CT mountpoints

for now allows the following non-problematic ones:
* noexec - Do not permit execution of binaries on the mounted FS
* noatime - Do not update inode access times on this filesystem
* nosuid - Do not allow suid or sgid bits to take effect
* nodev - Do not interpret character or block devices on the FS

Signed-off-by: Oguz Bektas <o.bektas@proxmox.com>

diff --git a/src/PVE/LXC.pm b/src/PVE/LXC.pm
index 4922fb00188ac0565a5819b847041df2b8eff828..13ead7fd505d89ed5f2eea3dfb4e50af464b095e 100644 (file)
--- a/src/PVE/LXC.pm
+++ b/src/PVE/LXC.pm
@@ -1415,11 +1415,19 @@ sub mountpoint_mount {
 
     die "unknown snapshot path for '$volid'" if !$storage && defined($snapname);
 
-    my $optstring = '';
+    my @mountoptions= split(/;/, $mountpoint->{mountoptions});
+    my $optlist = [];
+    my $allowed_options = PVE::LXC::Config::get_mount_options();
+    foreach my $opt (@mountoptions) {
+       push @$optlist, $opt if $opt =~ $allowed_options
+    }
+
     my $acl = $mountpoint->{acl};
     if (defined($acl)) {
-       $optstring .= ($acl ? 'acl' : 'noacl');
+       push @$optlist, ($acl ? 'acl' : 'noacl');
     }
+
+    my $optstring = join(',', @$optlist);
     my $readonly = $mountpoint->{ro};
 
     my @extra_opts;

diff --git a/src/PVE/LXC/Config.pm b/src/PVE/LXC/Config.pm
index 8dcd73c9b8320d77724d395ad7897bd2b849c9bc..71788bae2cf0e989e1003fae015093b22a37d0f0 100644 (file)
--- a/src/PVE/LXC/Config.pm
+++ b/src/PVE/LXC/Config.pm
@@ -216,6 +216,12 @@ sub __snapshot_foreach_volume {
 
 cfs_register_file('/lxc/', \&parse_pct_config, \&write_pct_config);
 
+my $mount_option = qr/(noatime|nodev|nosuid|noexec)/;
+
+sub get_mount_options {
+    return $mount_option;
+}
+
 my $rootfs_desc = {
     volume => {
        type => 'string',
@@ -236,6 +242,13 @@ my $rootfs_desc = {
        description => 'Explicitly enable or disable ACL support.',
        optional => 1,
     },
+    mountoptions => {
+       optional => 1,
+       type => 'string',
+       description => 'Extra mount options for rootfs/mps.',
+       format_description => 'opt[;opt...]',
+       pattern => qr/$mount_option(;$mount_option)*/,
+    },
     ro => {
        type => 'boolean',
        description => 'Read-only mount point',