unshare: mount proc differently depending on root privileges

2026-03-19 11:26:10 +01:00
parent 2b6207981a
commit 7640952bdc
2 changed files with 71 additions and 6 deletions
@@ -207,11 +207,22 @@ impl UnshareDriver {
            cmd.arg("-w").arg(dir);
        }

-        cmd.arg("--").arg("bash").arg("-c").arg(format!(
-            "mount -t proc proc /proc; mkdir /dev/pts; mount -t devpts devpts /dev/pts; touch /dev/ptmx; mount --bind /dev/pts/ptmx /dev/ptmx; {} {}",
-            program,
-            args.iter().map(|a| format!("\"{a}\"")).collect::<Vec<_>>().join(" ")
-        ));
+        // Build the bash command: set up /dev/pts and run the program
+        // /proc should already be bind-mounted from the host before entering the namespace
+        let program_args = args
+            .iter()
+            .map(|a| format!("\"{a}\""))
+            .collect::<Vec<_>>()
+            .join(" ");
+
+        cmd.arg("--")
+            .arg("bash")
+            .arg("-c")
+            .arg(format!(
+                "mkdir -p /dev/pts; mount -t devpts devpts /dev/pts 2>/dev/null || true; touch /dev/ptmx; mount --bind /dev/pts/ptmx /dev/ptmx 2>/dev/null || true; {} {}",
+                program,
+                program_args
+            ));

        cmd
    }