Messages in this thread Patch in this message | | | From | "" <> | Subject | Could not mount sysfs when enable userns but disable netns | Date | Fri, 11 Jul 2014 07:27:53 +0000 |
| |
Hello,
How to reproduce: 1. Prepare a container, enable userns and disable netns 2. use libvirt-lxc to start a container 3. libvirt could not mount sysfs then failed to start.
Then I found that commit 7dc5dbc879bd0779924b5132a48b731a0bc04a1e says: "Don't allow mounting sysfs unless the caller has CAP_SYS_ADMIN rights over the net namespace."
But why should we check sysfs mouont permission over net namespace? We've already checked CAP_SYS_ADMIN though.
What the relationship between sysfs and net namespace, or this check is a little redundant?
Any insights on this?
Thanks, - Chen
PS: codes below could be a workaround
@@ -34,7 +35,8 @@ static struct dentry *sysfs_mount(struct file_system_type *fs_type, if (!capable(CAP_SYS_ADMIN) && !fs_fully_visible(fs_type)) return ERR_PTR(-EPERM); - if (!kobj_ns_current_may_mount(KOBJ_NS_TYPE_NET)) + if (current->nsproxy->net_ns != &init_net && + !kobj_ns_current_may_mount(KOBJ_NS_TYPE_NET)) return ERR_PTR(-EPERM); }
| |