Can't get mount namespaces to behave as expected [LWN.net]

Can't get mount namespaces to behave as expected

Posted Mar 5, 2015 2:04 UTC (Thu) by apollock (guest, #14629)
Parent article: Namespaces in operation, part 4: more on PID namespaces

Hi, I'm messing around with your utilities, as well as unshare and the first commentator's newns, and I can't seem to get mount namespaces to work as I'd expect.

I'm creating a new everything, i.e.
sudo unshare --mount --uts --net --pid --fork --mount-proc /bin/bash
sudo /tmp/newns --uts --mount --pid --init --net /bin/bash
sudo /tmp/ns_child_exec -p -m /tmp/simple_init

and then unmounting a filesystem from that shell, and it's getting unmounted in another shell that hasn't been interacting with the namespace, which isn't what I would have expected? Similarly, if I mount /proc in the last two example invocations above, it clobbers the systemwide /proc mount with what's going on inside my new PID namespace. Also not what I would have expected?

I'm using 3.19.0

to post comments

Can't get mount namespaces to behave as expected

Posted Mar 5, 2015 9:25 UTC (Thu) by mkerrisk (subscriber, #1978) [Link] (5 responses)

@apollock: yes, I recently commented on this in another article in this series. Basically, some distros (e.g., Fedora) these days enable mount propagation by default, which means that when you mount /proc in the new mount namespace, you do indeed clobber /proc in the initial mount namespace.

So, in the new namespace, you need to disable propagation of mount events on /, either by making it a private mount (prevents propagation in both directions) or by making it a slave mount (allows propagation of mounts events under / into the new namespace, but doesn't propagate events outside the new namespace. So, for example, in the shell session under the heading Mounting a procfs filesystem (revisited), we should add one further shell command:

# ./ns_child_exec -p -m ./simple_init
init$ mount --make-slave /            # <== NEW
init$ mount -t proc proc /proc
init$ ps a

For more info about mount propagation, see the kernel source file Documentation/filesystems/sharedsubtree.txt and the mount(8) man page.

Can't get mount namespaces to behave as expected

Posted Mar 5, 2015 23:55 UTC (Thu) by apollock (guest, #14629) [Link] (4 responses)

Thanks for the quick response.

It looks like I have to do the same thing to /proc prior to mounting it

Can't get mount namespaces to behave as expected

Posted Mar 6, 2015 9:19 UTC (Fri) by mkerrisk (subscriber, #1978) [Link] (3 responses)

> Thanks for the quick response.

Actually, it was quite by chance. I happened to be checking some details in these articles myself.

> It looks like I have to do the same thing to /proc prior to mounting it

I don't believe that should be necessary. What makes you think that it is?

Can't get mount namespaces to behave as expected

Posted Mar 7, 2015 7:53 UTC (Sat) by apollock (guest, #14629) [Link] (2 responses)

Because /proc was still getting clobbered outside of my namespace without it when I mounted it inside my namespace.

I was basically testing two scenarios:

1) Unmounting a filesystem that was mounted inside and outside the new namespace. Expected behaviour: it was only unmounted inside the new namespace

2) Mounting /proc inside the new namespace. Expected behaviour: only seeing the process entries for processes inside the new namespace inside the namespace, and there being no impact outside this namespace

Can't get mount namespaces to behave as expected

Posted Mar 7, 2015 10:04 UTC (Sat) by mkerrisk (subscriber, #1978) [Link] (1 responses)

So, going back to your earlier comment:

> It looks like I have to do the same thing to /proc prior to mounting it

Yes, you're right. I was getting confused with another case, where if we mount a procfs at a location other than the usual /proc, then we need to make / a private or slave mount in order not to have that mount appear in the initial mount namespace.

So, in fact all that's needed if we're mounting at /proc inside the simple_init program is

# ./ns_child_exec -p -m ./simple_init
init$ mount --make-slave /proc            # <== NEW
init$ mount -t proc proc /proc
init$ ps a

Nothing needs to be done to /, as far as I can tell.

Can't get mount namespaces to behave as expected

Posted Oct 10, 2017 1:54 UTC (Tue) by marcosps (subscriber, #115562) [Link]

Hello Michael,

what do you think about changing the article adding the --make-slave parameter mount? It made me turn off my computer twice, as the system gets unstable (at least n my fedora 26)...