support_enter_mount_namespace: Unshare with mount --make-rprivate

System defaults vary, and a mere unshare (CLONE_NEWNS) (which is part of
support_become_root) is no longer sufficient.

Reviewed-by: Christian Brauner <christian.brauner@ubuntu.com>

1 files changed, 5 insertions, 0 deletions

diff --git a/support/namespace.h b/support/namespace.h
index 9eddb1a0e9..b5e2d1474a 100644
--- a/support/namespace.h
+++ b/support/namespace.h
@@ -51,6 +51,11 @@ bool support_can_chroot (void);
    has sufficient privileges.  */
 bool support_enter_network_namespace (void);
 
+/* Enter a mount namespace and mark / as private (not shared).  If
+   this function returns true, mount operations in this process will
+   not affect the host system afterwards.  */
+bool support_enter_mount_namespace (void);
+
 /* Return true if support_enter_network_namespace managed to enter a
    UTS namespace.  */
 bool support_in_uts_namespace (void);