[libvirt] [PATCH RFC] LXC: don't RO mount /proc, /sys when user namespce enabled

[Richard Weinberger]

Am 24.12.2014 um 03:23 schrieb Chen, Hanxiao:
> 
> 
>> -----Original Message-----
>> From: Richard Weinberger [mailto:richard.weinberger at gmail.com]
>> Sent: Wednesday, December 24, 2014 5:36 AM
>> To: Eric Blake
>> Cc: Chen, Hanxiao/陈 晗霄; libvir-list at redhat.com
>> Subject: Re: [libvirt] [PATCH RFC] LXC: don't RO mount /proc, /sys when user
>> namespce enabled
>>
>> On Mon, Dec 22, 2014 at 4:12 PM, Eric Blake <eblake at redhat.com> wrote:
>>> On 12/21/2014 08:57 PM, Chen Hanxiao wrote:
>>>
>>> s/namespce/namespace/ in the subject line
>>>
>>>> If we enabled user ns and provided a uid/gid map,
>>>> we do not need to mount /proc, /sys as readonly.
>>>> Leave it to kernel for protection.
>>>>
>>>> Signed-off-by: Chen Hanxiao <chenhanxiao at cn.fujitsu.com>
>>>> ---
>>>>  src/lxc/lxc_container.c | 6 ++++++
>>>>  1 file changed, 6 insertions(+)
>>>
>>> I'll leave the actual patch review to someone more familiar with LXC
>>> namespace setups
>>
>> This change will still mount some useless stuff like:
>>     { "/.oldroot/proc/sys/net/ipv4", "/proc/sys/net/ipv4", NULL,
>> MS_BIND, false, false, true },
>>     { "/.oldroot/proc/sys/net/ipv6", "/proc/sys/net/ipv6", NULL,
>> MS_BIND, false, false, true },
>>
>> You can set skipUserNS for these.
> 
> Thanks, I didn't notice that.
> 
>>
>> But I *really* would like to see /proc and /sys mounted RW as default.
>> Please see my comment to:
>> [libvirt] [PATCHv3] lxc: give RW access to /proc/sys/net/ipv[46] to containers
> 
> I see your new comments in that thread.
> If libvirt enable userns(provided a uid/gid map in XML),
> it's safe to drop RO mount completely;
> If not, I'm not sure whether it will bring back compatibility issues.
> 
> So let's wait for more comments from maintainers.

I Agree

Thanks,
//richard