am d2f9bf3a: Merge "Keep /mnt/secure private to default namespace." into jb-mr1-dev
* commit 'd2f9bf3addaa586c0dbc303508caf02c66dc03b9':
Keep /mnt/secure private to default namespace.
diff --git a/rootdir/init.rc b/rootdir/init.rc
index fc678f0..3d57211 100644
--- a/rootdir/init.rc
+++ b/rootdir/init.rc
@@ -63,6 +63,8 @@
# Directory for putting things only root should see.
mkdir /mnt/secure 0700 root root
+ # Create private mountpoint so we can MS_MOVE from staging
+ mount tmpfs tmpfs /mnt/secure mode=0700,uid=0,gid=0
# Directory for staging bindmounts
mkdir /mnt/secure/staging 0700 root root
@@ -135,6 +137,7 @@
mount rootfs rootfs / ro remount
# mount shared so changes propagate into child namespaces
mount rootfs rootfs / shared rec
+ mount tmpfs tmpfs /mnt/secure private rec
# We chown/chmod /cache again so because mount is run as root + defaults
chown system cache /cache