Re: [libvirt] [RFC PATCH 2/2] LXC: Create ro overlay mounts only if we're not within a user namespace

2013-07-01 Thread Gao feng
On 07/01/2013 07:57 PM, Gao feng wrote: > On 07/01/2013 07:05 PM, Richard Weinberger wrote: >> Am 01.07.2013 12:33, schrieb Daniel P. Berrange: >>> On Mon, Jul 01, 2013 at 08:29:14AM +0200, Richard Weinberger wrote: Am 01.07.2013 04:26, schrieb Gao feng: >> Well, given that we're at rc2 no

Re: [libvirt] [RFC PATCH 2/2] LXC: Create ro overlay mounts only if we're not within a user namespace

2013-07-01 Thread Gao feng
On 07/01/2013 07:05 PM, Richard Weinberger wrote: > Am 01.07.2013 12:33, schrieb Daniel P. Berrange: >> On Mon, Jul 01, 2013 at 08:29:14AM +0200, Richard Weinberger wrote: >>> Am 01.07.2013 04:26, schrieb Gao feng: > Well, given that we're at rc2 now & I'm still unclear about how some > asp

Re: [libvirt] [RFC PATCH 2/2] LXC: Create ro overlay mounts only if we're not within a user namespace

2013-07-01 Thread Richard Weinberger
Am 01.07.2013 13:44, schrieb Richard Weinberger: > Am 01.07.2013 13:35, schrieb Daniel P. Berrange: >> On Mon, Jul 01, 2013 at 01:25:28PM +0200, Richard Weinberger wrote: >>> Am 01.07.2013 13:22, schrieb Daniel P. Berrange: On Mon, Jul 01, 2013 at 01:05:23PM +0200, Richard Weinberger wrote: >>

Re: [libvirt] [RFC PATCH 2/2] LXC: Create ro overlay mounts only if we're not within a user namespace

2013-07-01 Thread Richard Weinberger
Am 01.07.2013 13:35, schrieb Daniel P. Berrange: > On Mon, Jul 01, 2013 at 01:25:28PM +0200, Richard Weinberger wrote: >> Am 01.07.2013 13:22, schrieb Daniel P. Berrange: >>> On Mon, Jul 01, 2013 at 01:05:23PM +0200, Richard Weinberger wrote: Am 01.07.2013 12:33, schrieb Daniel P. Berrange: >>

Re: [libvirt] [RFC PATCH 2/2] LXC: Create ro overlay mounts only if we're not within a user namespace

2013-07-01 Thread Daniel P. Berrange
On Mon, Jul 01, 2013 at 01:25:28PM +0200, Richard Weinberger wrote: > Am 01.07.2013 13:22, schrieb Daniel P. Berrange: > > On Mon, Jul 01, 2013 at 01:05:23PM +0200, Richard Weinberger wrote: > >> Am 01.07.2013 12:33, schrieb Daniel P. Berrange: > >>> On Mon, Jul 01, 2013 at 08:29:14AM +0200, Richar

Re: [libvirt] [RFC PATCH 2/2] LXC: Create ro overlay mounts only if we're not within a user namespace

2013-07-01 Thread Richard Weinberger
Am 01.07.2013 13:22, schrieb Daniel P. Berrange: > On Mon, Jul 01, 2013 at 01:05:23PM +0200, Richard Weinberger wrote: >> Am 01.07.2013 12:33, schrieb Daniel P. Berrange: >>> On Mon, Jul 01, 2013 at 08:29:14AM +0200, Richard Weinberger wrote: Any ideas what's going on here? >>> >>> No, it is v

Re: [libvirt] [RFC PATCH 2/2] LXC: Create ro overlay mounts only if we're not within a user namespace

2013-07-01 Thread Daniel P. Berrange
On Mon, Jul 01, 2013 at 01:05:23PM +0200, Richard Weinberger wrote: > Am 01.07.2013 12:33, schrieb Daniel P. Berrange: > > On Mon, Jul 01, 2013 at 08:29:14AM +0200, Richard Weinberger wrote: > >> Any ideas what's going on here? > > > > No, it is very odd. It smells like a kernel issue to me. What

Re: [libvirt] [RFC PATCH 2/2] LXC: Create ro overlay mounts only if we're not within a user namespace

2013-07-01 Thread Richard Weinberger
Am 01.07.2013 12:33, schrieb Daniel P. Berrange: > On Mon, Jul 01, 2013 at 08:29:14AM +0200, Richard Weinberger wrote: >> Am 01.07.2013 04:26, schrieb Gao feng: Well, given that we're at rc2 now & I'm still unclear about how some aspects of the userns setup is working, I'm afraid we'll ha

Re: [libvirt] [RFC PATCH 2/2] LXC: Create ro overlay mounts only if we're not within a user namespace

2013-07-01 Thread Daniel P. Berrange
On Mon, Jul 01, 2013 at 08:29:14AM +0200, Richard Weinberger wrote: > Am 01.07.2013 04:26, schrieb Gao feng: > >> Well, given that we're at rc2 now & I'm still unclear about how some > >> aspects of the userns setup is working, I'm afraid we'll have to wait > >> until 1.1.1 for the userns LXC code

Re: [libvirt] [RFC PATCH 2/2] LXC: Create ro overlay mounts only if we're not within a user namespace

2013-06-30 Thread Richard Weinberger
Am 01.07.2013 04:26, schrieb Gao feng: >> Well, given that we're at rc2 now & I'm still unclear about how some >> aspects of the userns setup is working, I'm afraid we'll have to wait >> until 1.1.1 for the userns LXC code to merge. I'll aim todo it next >> week, so that we have plenty of time for

Re: [libvirt] [RFC PATCH 2/2] LXC: Create ro overlay mounts only if we're not within a user namespace

2013-06-30 Thread Gao feng
On 06/28/2013 06:17 PM, Daniel P. Berrange wrote: > On Thu, Jun 27, 2013 at 08:56:25AM +0800, Gao feng wrote: >> On 06/26/2013 07:01 PM, Daniel P. Berrange wrote: >>> On Wed, Jun 26, 2013 at 05:56:19PM +0800, Gao feng wrote: On 06/26/2013 05:38 PM, Daniel P. Berrange wrote: > On Wed, Jun 2

Re: [libvirt] [RFC PATCH 2/2] LXC: Create ro overlay mounts only if we're not within a user namespace

2013-06-28 Thread Daniel P. Berrange
On Thu, Jun 27, 2013 at 08:56:25AM +0800, Gao feng wrote: > On 06/26/2013 07:01 PM, Daniel P. Berrange wrote: > > On Wed, Jun 26, 2013 at 05:56:19PM +0800, Gao feng wrote: > >> On 06/26/2013 05:38 PM, Daniel P. Berrange wrote: > >>> On Wed, Jun 26, 2013 at 10:26:10AM +0800, Gao feng wrote: > O

Re: [libvirt] [RFC PATCH 2/2] LXC: Create ro overlay mounts only if we're not within a user namespace

2013-06-26 Thread Gao feng
On 06/26/2013 07:01 PM, Daniel P. Berrange wrote: > On Wed, Jun 26, 2013 at 05:56:19PM +0800, Gao feng wrote: >> On 06/26/2013 05:38 PM, Daniel P. Berrange wrote: >>> On Wed, Jun 26, 2013 at 10:26:10AM +0800, Gao feng wrote: On 06/26/2013 04:39 AM, Daniel P. Berrange wrote: > On Thu, Jun 1

Re: [libvirt] [RFC PATCH 2/2] LXC: Create ro overlay mounts only if we're not within a user namespace

2013-06-26 Thread Gao feng
On 06/26/2013 07:01 PM, Daniel P. Berrange wrote: > On Wed, Jun 26, 2013 at 05:56:19PM +0800, Gao feng wrote: >> On 06/26/2013 05:38 PM, Daniel P. Berrange wrote: >>> On Wed, Jun 26, 2013 at 10:26:10AM +0800, Gao feng wrote: On 06/26/2013 04:39 AM, Daniel P. Berrange wrote: > On Thu, Jun 1

Re: [libvirt] [RFC PATCH 2/2] LXC: Create ro overlay mounts only if we're not within a user namespace

2013-06-26 Thread Daniel P. Berrange
On Wed, Jun 26, 2013 at 05:56:19PM +0800, Gao feng wrote: > On 06/26/2013 05:38 PM, Daniel P. Berrange wrote: > > On Wed, Jun 26, 2013 at 10:26:10AM +0800, Gao feng wrote: > >> On 06/26/2013 04:39 AM, Daniel P. Berrange wrote: > >>> On Thu, Jun 13, 2013 at 08:02:18PM +0200, Richard Weinberger wrote

Re: [libvirt] [RFC PATCH 2/2] LXC: Create ro overlay mounts only if we're not within a user namespace

2013-06-26 Thread Gao feng
On 06/26/2013 05:38 PM, Daniel P. Berrange wrote: > On Wed, Jun 26, 2013 at 10:26:10AM +0800, Gao feng wrote: >> On 06/26/2013 04:39 AM, Daniel P. Berrange wrote: >>> On Thu, Jun 13, 2013 at 08:02:18PM +0200, Richard Weinberger wrote: Within a user namespace root can remount these filesysems a

Re: [libvirt] [RFC PATCH 2/2] LXC: Create ro overlay mounts only if we're not within a user namespace

2013-06-26 Thread Daniel P. Berrange
On Wed, Jun 26, 2013 at 10:26:10AM +0800, Gao feng wrote: > On 06/26/2013 04:39 AM, Daniel P. Berrange wrote: > > On Thu, Jun 13, 2013 at 08:02:18PM +0200, Richard Weinberger wrote: > >> Within a user namespace root can remount these filesysems at any > >> time rw. > >> Create these mappings only i

Re: [libvirt] [RFC PATCH 2/2] LXC: Create ro overlay mounts only if we're not within a user namespace

2013-06-25 Thread Gao feng
On 06/26/2013 04:39 AM, Daniel P. Berrange wrote: > On Thu, Jun 13, 2013 at 08:02:18PM +0200, Richard Weinberger wrote: >> Within a user namespace root can remount these filesysems at any >> time rw. >> Create these mappings only if we're not playing with user namespaces. > > This is a problem wit

Re: [libvirt] [RFC PATCH 2/2] LXC: Create ro overlay mounts only if we're not within a user namespace

2013-06-25 Thread Gao feng
On 06/14/2013 02:02 AM, Richard Weinberger wrote: > Within a user namespace root can remount these filesysems at any > time rw. > Create these mappings only if we're not playing with user namespaces. Without user namespace,the root user of container can remount all of the filesystem too, since he

Re: [libvirt] [RFC PATCH 2/2] LXC: Create ro overlay mounts only if we're not within a user namespace

2013-06-25 Thread Daniel P. Berrange
On Thu, Jun 13, 2013 at 08:02:18PM +0200, Richard Weinberger wrote: > Within a user namespace root can remount these filesysems at any > time rw. > Create these mappings only if we're not playing with user namespaces. This is a problem with the way we're initializing mounts in the user namespace.

[libvirt] [RFC PATCH 2/2] LXC: Create ro overlay mounts only if we're not within a user namespace

2013-06-13 Thread Richard Weinberger
Within a user namespace root can remount these filesysems at any time rw. Create these mappings only if we're not playing with user namespaces. Signed-off-by: Richard Weinberger --- src/lxc/lxc_container.c | 42 +++--- 1 file changed, 23 insertions(+), 19 dele