If a container has no root, lxc still remounts /proc. If the system had marked / as MS_SHARED, as is the case in Fedora 11, then even though the container is in a new mounts namespace, the mount event is propagated back to the host mounts ns, overmounting the host's /proc. After that, ps -ef will no longer show host processes for a host admin.
So mark / as MS_SLAVE in a container after spawning a new mounts namespace, and before actually chrooting. This way the container will still receive mount events from the host. Signed-off-by: Serge Hallyn <[email protected]> --- src/lxc/conf.c | 10 ++++++++++ 1 files changed, 10 insertions(+), 0 deletions(-) diff --git a/src/lxc/conf.c b/src/lxc/conf.c index 6c3476a..d807ae3 100644 --- a/src/lxc/conf.c +++ b/src/lxc/conf.c @@ -60,6 +60,10 @@ #define MS_REC 16384 #endif +#ifndef MS_SLAVE +#define MS_SLAVE 1<<19 +#endif + typedef int (*instanciate_cb)(const char *directory, const char *file, pid_t pid); @@ -1847,6 +1851,12 @@ int lxc_setup(const char *name, const char *cons, return -LXC_ERROR_SETUP_TTY; } + /* Make sure we don't end up forwarding mount events back to parent */ + if (mount("", "/", NULL, MS_SLAVE|MS_REC, NULL) < 0) { + lxc_log_error("Failed to set host / as slave for '%s'", name); + return -LXC_ERROR_SETUP_ROOTFS; + } + if (conf_is_set(flags, rootfs) && setup_rootfs(name)) { lxc_log_error("failed to set rootfs for '%s'", name); return -LXC_ERROR_SETUP_ROOTFS; -- 1.6.2 _______________________________________________ Containers mailing list [email protected] https://lists.linux-foundation.org/mailman/listinfo/containers _______________________________________________ Devel mailing list [email protected] https://openvz.org/mailman/listinfo/devel
