> I was playing with the namespace support in uwsgi and could not get it to
> work
> when trying to build a filesystem with bind mounts rather than installing
> an
> entire new system. I took a look at the source and think I figured out
> why I
> was having problems.
>
> I added the option to recursively bind mount the directory given to the
> --namespace option, which fixed one problem. I hit another though when it
> tried to clean up the tmp mount for pivot_root. It was unmounting all the
> bind
> mounts, so this was worked around by making it a little more picky about
> what
> it unmounted.
>
> Here is a small patch in case anyone else would like to do something
> similar.
>
>
> --- a/lib/linux_ns.c
> +++ b/lib/linux_ns.c
> @@ -19,6 +19,8 @@ extern struct uwsgi_server uwsgi;
> #define CLONE_NEWNET 0x40000000
> #endif
>
> +#define TMP_NS_MOUNT "/.uwsgi_ns_tmp_mountpoint"
> +
> void linux_namespace_start(void *argv) {
> for (;;) {
> char stack[PTHREAD_STACK_MIN];
> @@ -98,13 +100,13 @@ void linux_namespace_jail() {
> }
>
> if (strcmp(uwsgi.ns, "/")) {
> - ns_tmp_mountpoint = uwsgi_concat2(uwsgi.ns,
> "/.uwsgi_ns_tmp_mountpoint");
> + ns_tmp_mountpoint = uwsgi_concat2(uwsgi.ns, TMP_NS_MOUNT);
> mkdir(ns_tmp_mountpoint, S_IRWXU);
>
> ns_tmp_mountpoint2 = uwsgi_concat2(ns_tmp_mountpoint,
> "/.uwsgi_ns_tmp_mountpoint");
> mkdir(ns_tmp_mountpoint2, S_IRWXU);
>
> - if (mount(uwsgi.ns, ns_tmp_mountpoint, "none", MS_BIND, NULL)) {
> + if (mount(uwsgi.ns, ns_tmp_mountpoint, "none", MS_BIND|MS_REC,
> NULL)) {
> uwsgi_error("mount()");
> }
> if (chdir(ns_tmp_mountpoint)) {
> @@ -139,9 +141,9 @@ void linux_namespace_jail() {
> delim0++;
> delim1 = strchr(delim0, ' ');
> *delim1 = 0;
> - if (!strcmp(delim0, "/") || !strcmp(delim0, "/proc"))
> - continue;
> - if (!umount(delim0)) {
> + if ( !strncmp(delim0, TMP_NS_MOUNT,
> strlen(TMP_NS_MOUNT))
> + && !umount(delim0)) {
> +
> unmounted++;
> }
> }
>
I think we need a way to better define bind-mounts in jails (or for the
--unshare option)
Something like
uwsgi --unshare mount --bind-mount /foo=/bar --bind-mount /one=/two
--root-mount /jail001/myroot
could be an enough-generic solution
--
Roberto De Ioris
http://unbit.it
_______________________________________________
uWSGI mailing list
[email protected]
http://lists.unbit.it/cgi-bin/mailman/listinfo/uwsgi
