I was playing with the namespace support in uwsgi and could not get it to work
when trying to build a filesystem with bind mounts rather than installing an
entire new system. I took a look at the source and think I figured out why I
was having problems.
I added the option to recursively bind mount the directory given to the
--namespace option, which fixed one problem. I hit another though when it
tried to clean up the tmp mount for pivot_root. It was unmounting all the bind
mounts, so this was worked around by making it a little more picky about what
it unmounted.
Here is a small patch in case anyone else would like to do something similar.
--- a/lib/linux_ns.c
+++ b/lib/linux_ns.c
@@ -19,6 +19,8 @@ extern struct uwsgi_server uwsgi;
#define CLONE_NEWNET 0x40000000
#endif
+#define TMP_NS_MOUNT "/.uwsgi_ns_tmp_mountpoint"
+
void linux_namespace_start(void *argv) {
for (;;) {
char stack[PTHREAD_STACK_MIN];
@@ -98,13 +100,13 @@ void linux_namespace_jail() {
}
if (strcmp(uwsgi.ns, "/")) {
- ns_tmp_mountpoint = uwsgi_concat2(uwsgi.ns,
"/.uwsgi_ns_tmp_mountpoint");
+ ns_tmp_mountpoint = uwsgi_concat2(uwsgi.ns, TMP_NS_MOUNT);
mkdir(ns_tmp_mountpoint, S_IRWXU);
ns_tmp_mountpoint2 = uwsgi_concat2(ns_tmp_mountpoint,
"/.uwsgi_ns_tmp_mountpoint");
mkdir(ns_tmp_mountpoint2, S_IRWXU);
- if (mount(uwsgi.ns, ns_tmp_mountpoint, "none", MS_BIND, NULL)) {
+ if (mount(uwsgi.ns, ns_tmp_mountpoint, "none", MS_BIND|MS_REC,
NULL)) {
uwsgi_error("mount()");
}
if (chdir(ns_tmp_mountpoint)) {
@@ -139,9 +141,9 @@ void linux_namespace_jail() {
delim0++;
delim1 = strchr(delim0, ' ');
*delim1 = 0;
- if (!strcmp(delim0, "/") || !strcmp(delim0, "/proc"))
- continue;
- if (!umount(delim0)) {
+ if ( !strncmp(delim0, TMP_NS_MOUNT,
strlen(TMP_NS_MOUNT))
+ && !umount(delim0)) {
+
unmounted++;
}
}
_______________________________________________
uWSGI mailing list
[email protected]
http://lists.unbit.it/cgi-bin/mailman/listinfo/uwsgi
