Messages in this thread | | | From | (Eric W. Biederman) | Date | Mon, 26 Nov 2012 08:38:58 -0600 | Subject | Re: [PATCH 1/2] autofs4: allow autofs to work outside the initial PID namespace |
| |
Miklos Szeredi <miklos@szeredi.hu> writes:
> On Mon, Nov 26, 2012 at 3:29 AM, Ian Kent <raven@themaw.net> wrote: >>> > > MS_UNBINDABLE says: skip this mount when copying a mount tree, such >>> > > as when the mount namespace is cloned. >>> > > >>> > > If you set MS_UNBINDABLE on autofs mounts then they will simply not >>> > > appear in a cloned namespace. Which sounds like a good idea, no? >>> > >>> > Good point. If the desire is for a mount to be managed by autofs >>> > setting MS_UNBINDABLE seems required. >>> >>> Arrgh, I know that's something I should have looked into long ago. >>> The fact is that autofs mounts are directly related to a specific path >>> defined by automount maps that are associated with the daemon so bind >>> mounting them elsewhere makes no sense. >> >> Except, AFAICS, they do appear in the clone. > > Hmm, yes, apparently the semantics of MS_UNBINDABLE only apply to > actual bind mounts not to namespace cloning. Even though the two > operations are closely related. Not sure why this is so, but it is > probably not a good idea to change the semantics at this point.
And for whatever reason this appears deliberate.
CL_COPY_ALL in copy_tree allows the copy.
The selected semantics of namespace sharing tend to mystify me.
So I don't know how much MS_UNBINDABLE helps over MS_PRIVATE. Both prevent propogation of changes to other namespaces. I don't know how much using MS_UNBINDABLE to also prevent bind mounts helps.
Eric
| |