[libvirt] [PATCH RFC] LXC: don't RO mount /proc, /sys when user namespce enabled
Richard Weinberger
richard.weinberger at gmail.com
Tue Dec 23 21:36:04 UTC 2014
On Mon, Dec 22, 2014 at 4:12 PM, Eric Blake <eblake at redhat.com> wrote:
> On 12/21/2014 08:57 PM, Chen Hanxiao wrote:
>
> s/namespce/namespace/ in the subject line
>
>> If we enabled user ns and provided a uid/gid map,
>> we do not need to mount /proc, /sys as readonly.
>> Leave it to kernel for protection.
>>
>> Signed-off-by: Chen Hanxiao <chenhanxiao at cn.fujitsu.com>
>> ---
>> src/lxc/lxc_container.c | 6 ++++++
>> 1 file changed, 6 insertions(+)
>
> I'll leave the actual patch review to someone more familiar with LXC
> namespace setups
This change will still mount some useless stuff like:
{ "/.oldroot/proc/sys/net/ipv4", "/proc/sys/net/ipv4", NULL,
MS_BIND, false, false, true },
{ "/.oldroot/proc/sys/net/ipv6", "/proc/sys/net/ipv6", NULL,
MS_BIND, false, false, true },
You can set skipUserNS for these.
But I *really* would like to see /proc and /sys mounted RW as default.
Please see my comment to:
[libvirt] [PATCHv3] lxc: give RW access to /proc/sys/net/ipv[46] to containers
--
Thanks,
//richard
More information about the libvir-list
mailing list