Messages in this thread | | | Date | Tue, 7 Oct 2014 14:30:40 +0100 | From | Al Viro <> | Subject | Re: [PATCH] [RFC] mnt: add ability to clone mntns starting with the current root |
| |
On Tue, Oct 07, 2014 at 04:12:57PM +0400, Andrey Vagin wrote: > Another problem is that rootfs can't be hidden from a container, because > rootfs can't be moved or umounted.
... which is a bug in mntns_install(), AFAICS.
> Here is an example how to get access to rootfs: > fd = open("/proc/self/ns/mnt", O_RDONLY) > umount2("/", MNT_DETACH); > setns(fd, CLONE_NEWNS) > > rootfs may contain data, which should not be avaliable in CT-s.
Indeed.
> I suggest to add ability to create a mount namespace with specified > mount points. A current task root can be used as a root for the new > mount namespace.
Yecchh... Frankly, you are opening a big can of worms - having rootfs as absolute root of all namespaces simplifies a lot of things in there.
| |