[libvirt] [PATCH v2]lxc: don't mount dir if ownership couldn't be known

Gao feng gaofeng at cn.fujitsu.com
Mon Nov 18 00:37:51 UTC 2013


On 11/16/2013 12:24 AM, Daniel P. Berrange wrote:
> On Thu, Nov 14, 2013 at 05:44:40PM +0800, Chen Hanxiao wrote:
>>
>>
>>> -----Original Message-----
>>> From: Daniel P. Berrange [mailto:berrange at redhat.com]
>>> Sent: Wednesday, November 13, 2013 6:35 PM
>>> To: Chen Hanxiao
>>> Cc: libvir-list at redhat.com
>>> Subject: Re: [libvirt] [PATCH v2]lxc: don't mount dir if ownership couldn't be
>>> known
>>>
>>> On Wed, Nov 13, 2013 at 04:51:43PM +0800, Chen Hanxiao wrote:
>>>> From: Chen Hanxiao <chenhanxiao at cn.fujitsu.com>
>>>>
>>>> If we enable userns, we could bind mount
>>>> some dirs from host to guest, which don't belong to
>>>> the target mapped uid/gid.
>>>>
>>>> Such as we could bind mount root's dirs to guest.
>>>> What is worse, we could even modify root's files
>>>> in that bind dir inside container.
>>>
>>> I still can't see what the problem is from the description
>>> here. Please can you give a clear example of the config
>>> used and exactly what goes wrong.
>>>
>>
>> 1. enable user namespace
>>   <idmap>
>>     <uid start='0' target='1001' count='10'/>
>>     <gid start='0' target='1001' count='10'/>
>>   </idmap>
>>
>> 2. bind mount some dirs to container, which belongs to root or other users.
>>     <filesystem type='mount' accessmode='passthrough'>
>>       <source dir='/media/LXC1'/>
>>       <target dir='/mnt'/>
>>     </filesystem>
>>
>> # ll /media/
>> ...
>> drwxr-xr-x.  3 root root    4096 Nov 13 17:21 LXC1
>> ...
>>
>> 3. start container
>>
>> I used to encounter issues: inside container, we could modify files under /mnt
>>
>> So I think inside user namespace, if we do not have a proper id mapping,
>> we should not bind mount it for containers, or at least set it as readonly.
> 
> FYI, I'm trying to reproduce the problem myself, but have discovered
> that current kernels cause a regression which prevents libirt starting
> any user namespace kernels - it fails mounting /proc and /dev/pts
> 

FYI,I'm working on fix this bug. both kernel and libvirt need to be changed.




More information about the libvir-list mailing list