Fallback to bind mount for sysfs in user namespaces

libcontainer/rootfs_linux.go

@@ -622,7 +622,19 @@ func mountToRootfs(c *mountConfig, m mountEntry) error {
 		// "proc" and "sys" mounts need special handling (without resolving the
 		// destination) to avoid attacks.
 		m.dstFile = dstFile
-		return m.mountPropagate(rootfs, "")
+		err = m.mountPropagate(rootfs, "")
+		if err != nil && m.Device == "sysfs" && errors.Is(err, unix.EPERM) {
+			logrus.Debugf("cannot mount sysfs with properties, fallback to bind mount: %v", err)
+			bindM := &configs.Mount{
+				Device:           "bind",
+				Source:           "/sys",
+				Destination:      m.Destination,
+				Flags:            unix.MS_BIND | unix.MS_REC | m.Flags,
+				PropagationFlags: m.PropagationFlags,
+			}
+			return mountToRootfs(c, mountEntry{Mount: bindM})
+		}
+		return err
 	}
 
 	mountLabel := c.label

tests/integration/userns.bats

@@ -280,3 +280,17 @@ function teardown() {
 	# is deleted during the namespace cleanup.
 	run ! ip link del dummy0
 }
+
+@test "userns with host network: sysfs mount should fall back to bind mount" {
+	# Remove network namespace to use host network.
+	update_config '.linux.namespaces |= map(select(.type != "network"))'
+
+	# We check if /sys/class/net exists to verify that /sys is mounted
+	# correctly after the fallback.
+	update_config '.process.args = ["ls", "/sys/class/net"]'
+
+	runc run test_userns_sysfs_fallback
+	[ "$status" -eq 0 ]
+	# Check for loopback interface, which should always be present on the host.
+	[[ "$output" == *"lo"* ]]
+}