On Wed, Apr 29, 2020 at 11:26:49AM +0200, Miklos Szeredi wrote:
> On Wed, Apr 29, 2020 at 9:59 AM Miklos Szeredi <mszer...@redhat.com> wrote:
> >
> > On Tue, Apr 28, 2020 at 9:15 PM Dr. David Alan Gilbert
> > <dgilb...@redhat.com> wrote:
> >
> > > So our current sequence is:
> > >
> > > (new namespace)
> > > 1) if (mount(NULL, "/", NULL, MS_REC | MS_SLAVE, NULL) < 0) {
> > > 2) if (mount("proc", "/proc", "proc",
> > > ....
> > > 3) if (mount(source, source, NULL, MS_BIND | MS_REC, NULL) < 0) {
> > > 4) (chdir newroot, pivot, chdir oldroot)
> > > 5) if (mount("", ".", "", MS_SLAVE | MS_REC, NULL) < 0) {
> > > 6) if (umount2(".", MNT_DETACH) < 0) {
> > >
> > > So are you saying we need a:
> > > if (mount(NULL, "/", NULL, MS_REC | MS_SHARED, NULL) < 0) {
> > >
> > > and can this go straight after (1) ?
> >
> > Or right before (3). Important thing is that that new mount will
> > only receive propagation if the type of the mount at source (before
> > (3) is performed) is shared.
>
> And seems I was wrong. Bind mounting clones the slave property, hence
> no need to set MS_SHARED. I.e. if the source was a slave, the bind
> mount will be a slave to the same master as well; the two slaves won't
> receive propagation between each other, but both will receive
> propagation from the master.
Agreed. I was playing with it yesterday and noticed the same thing. Wanted
to test more before I said anything
Anyway, I did following.
$ mkdir /tmp/a /tmp/a/c /tmp/b
$ mount --bind /tmp/a /tmp/a
$ findmnt -o +PROPAGATION /tmp/a
TARGET SOURCE FSTYPE OPTIONS PROPAGATION
/tmp/a tmpfs[/a] tmpfs rw,nosuid,nodev,seclabel shared
$ cat /proc/self/mountifo | grep "/tmp/a"
613 49 0:45 /a /tmp/a rw,nosuid,nodev shared:30 - tmpfs tmpfs rw,seclabel
# Mountpoint /tmp/a is part of peer group "30"
# Create a new mount namespace with slave propagation
$ unshare -m --propagation slave bash
$ findmnt -o +PROPAGATION /tmp/a
TARGET SOURCE FSTYPE OPTIONS PROPAGATION
/tmp/a tmpfs[/a] tmpfs rw,nosuid,nodev,seclabel private,slave
$ cat /proc/self/mountinfo | grep /tmp/a
666 665 0:45 /a /tmp/a rw,nosuid,nodev master:30 - tmpfs tmpfs rw,seclabel
# /tmp/a in new mount namespace is slave of master "30"
# bind mount /tmp/a to /tmp/b and b should become slave of "30" too.
$ mount --bind /tmp/a /tmp/b
$findmnt -o +PROPAGATION /tmp/b
TARGET SOURCE FSTYPE OPTIONS PROPAGATION
/tmp/b tmpfs[/a] tmpfs rw,nosuid,nodev,seclabel private,slave
$ cat /proc/self/mountinfo | grep /tmp/b
671 665 0:45 /a /tmp/b rw,nosuid,nodev master:30 - tmpfs tmpfs rw,seclabel
# So /tmp/b is slave of "master:30" too. Say if host mounts something
# under /tmp/a (in init namespace), it should propagate to /tmp/a as
# well as /tmp/b in new mount namespace.
# Do following in init mount namespace
$ mount --bind /tmp/a/c /tmp/a/c
# Check in newly created mount namespace.
# findmnt
├─/tmp tmpfs tmpfs rw,nosuid,nodev,seclab
│ ├─/tmp/a tmpfs[/a] tmpfs rw,nosuid,nodev,seclab
│ │ └─/tmp/a/c tmpfs[/a/c] tmpfs rw,nosuid,nodev,seclab
│ ├─/tmp/b tmpfs[/a] tmpfs rw,nosuid,nodev,seclab
│ │ └─/tmp/b/c tmpfs[/a/c] tmpfs rw,nosuid,nodev,seclab
│ └─/tmp/a/c tmpfs[/a/c] tmpfs rw,nosuid,nodev,seclab
Mount of c has propagated into /tmp/b/c as well.
And that's what we want.
Thanks
Vivek
