mnt_newapi: use FSCONFIG_SET_STRING for key=value mount options

[koki-develop]

• Fixed createFilesystemMount() uses FSCONFIG_SET_FLAG for key=value mount options #253

Summary

Fixed createFilesystemMount() to use FSCONFIG_SET_STRING for key=value format options, instead of passing all mount options via FSCONFIG_SET_FLAG.

Fixes an issue where mounts with key=value options such as size=67108864 would fail with EINVAL in environments where the new mount API is active (kernel >= 6.3).

Background

createFilesystemMount() was splitting the options string by commas and passing all tokens via FSCONFIG_SET_FLAG. This works for boolean flags (ro, noexec), but fails for key=value parameters (size=67108864) because the kernel requires FSCONFIG_SET_STRING, which accepts the key and value as separate arguments.

Referenced the existing usage of FSCONFIG_SET_STRING in createDetachedTmpfs() in the same file:

const std::string size_str = std::to_string(size);
if (util::syscall(__NR_fsconfig, (uintptr_t)fs_fd, (uintptr_t)FSCONFIG_SET_STRING,
    (uintptr_t)"size",
    (uintptr_t)size_str.c_str(),
    (uintptr_t)0) < 0) {

Changes

Checks whether each option contains = and dispatches to the appropriate fsconfig command:

• Contains = → FSCONFIG_SET_STRING (splits and passes key and value separately)
• No = → FSCONFIG_SET_FLAG (existing behavior)

Test output

nsjail -Mo -R /bin:/bin -R /lib:/lib -R /usr:/usr \
  -m "none:/tmp:tmpfs:size=67108864" -- /bin/echo hello

[I][2026-03-03T08:48:18+0000] Executing '/bin/echo' for '[STANDALONE MODE]'
hello
[I][2026-03-03T08:48:18+0000] pid=26 ([STANDALONE MODE]) exited with status: 0, (PIDs left: 0)

Full log output

[I][2026-03-03T08:48:18+0000] Mode: STANDALONE_ONCE
[I][2026-03-03T08:48:18+0000] Jail parameters: hostname:'NSJAIL', chroot:'', process:'/bin/echo', bind:[::]:0, max_conns:0, max_conns_per_ip:0, time_limit:600, daemonize:false, clone_newnet:true, clone_newuser:true, clone_newns:true, clone_newpid:true, clone_newipc:true, clone_newuts:true, cgroupv2:false, keep_caps:false, disable_no_new_privs:false, max_cpus:0
[I][2026-03-03T08:48:18+0000] Mount: '/bin' -> '/bin' type:'' options:''
[I][2026-03-03T08:48:18+0000] Mount: '/lib' -> '/lib' type:'' options:''
[I][2026-03-03T08:48:18+0000] Mount: '/usr' -> '/usr' type:'' options:''
[I][2026-03-03T08:48:18+0000] Mount: 'none' -> '/tmp' type:'tmpfs' options:'size=67108864'
[I][2026-03-03T08:48:18+0000] Mount: '/proc' type:'proc' options:'' dir:true
[I][2026-03-03T08:48:18+0000] Uid map: inside_uid:0 outside_uid:0 count:1 newuidmap:false
[W][2026-03-03T08:48:18+0000][25] logParams():313 Process will be UID/EUID=0 in the global user namespace, and will have user root-level access to files
[I][2026-03-03T08:48:18+0000] Gid map: inside_gid:0 outside_gid:0 count:1 newgidmap:false
[W][2026-03-03T08:48:18+0000][25] logParams():323 Process will be GID/EGID=0 in the global user namespace, and will have group root-level access to files
[I][2026-03-03T08:48:18+0000] Executing '/bin/echo' for '[STANDALONE MODE]'
hello
[I][2026-03-03T08:48:18+0000] pid=26 ([STANDALONE MODE]) exited with status: 0, (PIDs left: 0)

[robertswiecki]

Good catch! Thank you