Isolation: added option to disable "procfs" mount.

Now users can disable the default procfs mount point
in the rootfs.

 {
     "isolation": {
         "automount": {
             "procfs": false
         }
     }
 }

1 files changed, 27 insertions, 18 deletions

diff --git a/src/nxt_isolation.c b/src/nxt_isolation.c
index f0ef625f..1e6323bc 100644
--- a/src/nxt_isolation.c
+++ b/src/nxt_isolation.c
@@ -485,11 +485,13 @@ nxt_isolation_set_automount(nxt_task_t *task, nxt_conf_value_t *isolation,
     static nxt_str_t  automount_name = nxt_string("automount");
     static nxt_str_t  langdeps_name = nxt_string("language_deps");
     static nxt_str_t  tmp_name = nxt_string("tmpfs");
+    static nxt_str_t  proc_name = nxt_string("procfs");
 
     automount = &process->isolation.automount;
 
     automount->language_deps = 1;
     automount->tmpfs = 1;
+    automount->procfs = 1;
 
     conf = nxt_conf_get_object_member(isolation, &automount_name, NULL);
     if (conf != NULL) {
@@ -502,6 +504,11 @@ nxt_isolation_set_automount(nxt_task_t *task, nxt_conf_value_t *isolation,
         if (value != NULL) {
             automount->tmpfs = nxt_conf_get_boolean(value);
         }
+
+        value = nxt_conf_get_object_member(conf, &proc_name, NULL);
+        if (value != NULL) {
+            automount->procfs = nxt_conf_get_boolean(value);
+        }
     }
 
     return NXT_OK;
@@ -609,27 +616,29 @@ nxt_isolation_set_lang_mounts(nxt_task_t *task, nxt_process_t *process,
         *p = '\0';
     }
 
-    mnt = nxt_array_add(mounts);
-    if (nxt_slow_path(mnt == NULL)) {
-        return NXT_ERROR;
-    }
+    if (process->isolation.automount.procfs) {
+        mnt = nxt_array_add(mounts);
+        if (nxt_slow_path(mnt == NULL)) {
+            return NXT_ERROR;
+        }
 
-    mnt->name = (u_char *) "proc";
-    mnt->type = NXT_FS_PROC;
-    mnt->src = (u_char *) "none";
-    mnt->dst = nxt_mp_nget(mp, rootfs_len + nxt_length("/proc") + 1);
-    if (nxt_slow_path(mnt->dst == NULL)) {
-        return NXT_ERROR;
-    }
+        mnt->name = (u_char *) "proc";
+        mnt->type = NXT_FS_PROC;
+        mnt->src = (u_char *) "none";
+        mnt->dst = nxt_mp_nget(mp, rootfs_len + nxt_length("/proc") + 1);
+        if (nxt_slow_path(mnt->dst == NULL)) {
+            return NXT_ERROR;
+        }
 
-    p = nxt_cpymem(mnt->dst, rootfs, rootfs_len);
-    p = nxt_cpymem(p, "/proc", 5);
-    *p = '\0';
+        p = nxt_cpymem(mnt->dst, rootfs, rootfs_len);
+        p = nxt_cpymem(p, "/proc", 5);
+        *p = '\0';
 
-    mnt->data = (u_char *) "";
-    mnt->flags = NXT_FS_FLAGS_NOEXEC | NXT_FS_FLAGS_NOSUID;
-    mnt->builtin = 1;
-    mnt->deps = 0;
+        mnt->data = (u_char *) "";
+        mnt->flags = NXT_FS_FLAGS_NOEXEC | NXT_FS_FLAGS_NOSUID;
+        mnt->builtin = 1;
+        mnt->deps = 0;
+    }
 
     qsort(mounts->elts, mounts->nelts, sizeof(nxt_fs_mount_t),
           nxt_isolation_mount_compare);