core/mount: fix getUnprivilegedMountFlags iterating over indices instead of values

lukefr09 · k8s-infra-cherrypick-robot · commit 07b2cc07e4f3 · 2026-02-26T10:38:35.000Z
The loop `for flag := range unprivilegedFlags` iterates over slice
indices (0,1,2,3,4,5,6) rather than the actual flag values (MS_RDONLY,
MS_NODEV, etc). This was a porting error from moby/moby where the data
structure was a map (where `for k := range m` yields keys/values).

As a result, MS_NOEXEC, MS_NOATIME, MS_RELATIME, and MS_NODIRATIME are
never detected or preserved. In user namespaces, this causes bind-mount
remounts to fail with EPERM when any of these flags are locked on the
parent mount, because the kernel requires all CL_UNPRIVILEGED locked
flags to be preserved during remount.

MS_RDONLY (0x1), MS_NOSUID (0x2), and MS_NODEV (0x4) happened to work
by coincidence because their values equal low index numbers.

Fix by using `for _, flag := range` to iterate over values.

Signed-off-by: Luke Hinds &lt;luke@stacklok.com&gt;
diff --git a/core/mount/mount_linux.go b/core/mount/mount_linux.go
@@ -231,7 +231,7 @@ func getUnprivilegedMountFlags(path string) (int, error) {
 	}
 
 	var flags int
-	for flag := range unprivilegedFlags {
+	for _, flag := range unprivilegedFlags {
 		if int(statfs.Flags)&flag == flag {
 			flags |= flag
 		}

Original file line number	Diff line number	Diff line change
`@@ -231,7 +231,7 @@ func getUnprivilegedMountFlags(path string) (int, error) {`
`231`	`231`	`}`
`232`	`232`
`233`	`233`	`var flags int`
`234`		`- for flag := range unprivilegedFlags {`
	`234`	`+ for _, flag := range unprivilegedFlags {`
`235`	`235`	`if int(statfs.Flags)&flag == flag {`
`236`	`236`	`flags \|= flag`
`237`	`237`	`}`