OK, I think I have a better understanding of this mount propagation thingy now.
First of all, the "remount" of `/` we do in the unshare plugin isn't really a
remount, it merely changes the propagation type of an existing mount. In fact,
the `source` argument is ignored by `mount()` in this case. We should probably
replace it with `NULL` to make it less confusing.
What the call does here is that it recursively changes the propagation type of
`/` to *private* (`MS_REC | MS_PRIVATE`). This is needed because, by default
(on Linux at least), `/` defaults to *shared*, meaning that any mount events
occurring in the parent namespace will propagate to our new namespace as well
(and vice-versa). That's not what we want, obviously, we want full isolation.
Much like the `unshare` command which assumes the user indeed wants full
isolation by default, so it performs the equivalent of our `mount()` call upon
entering the new namespace. In the shell, the equivalent is `mount
--make-rprivate /`. You can actually disable that by passing `--propagate
unchanged` to `unshare`.
In fact, I've tried this with the unshare plugin by buildling a simple package
with a `%post` scriptlet that shows the mount points, and indeed, with the
`mount()` call commented out, a mount point that I mounted on the host during
the scriptlet's execution (i.e. after the creation of the namespace) did
propagate to the namespace.
So that explains the "mysterious" `mount()` call.
Now, the reason it fails in a chroot is simple, it tries to change the
propagation type on the chrooted directory which (likely) is not a mount point.
This is basically what @pmatilai realized in the original ticket #3187 already.
The core issue here is that unshare & chroot are two competing operations, in a
sense. I think it would be better to make the unshare plugin somehow "replace"
the chroot functionality altogether, instead of trying to work around it. That,
or have a plugin hook in RPM that runs *before* chroot, which the unshare
plugin would then use instead and thus run the `mount()` call before chroot.
--
Reply to this email directly or view it on GitHub:
https://github.com/rpm-software-management/rpm/pull/3228#issuecomment-2361116252
You are receiving this because you are subscribed to this thread.
Message ID: <rpm-software-management/rpm/pull/3228/[email protected]>
_______________________________________________
Rpm-maint mailing list
[email protected]
http://lists.rpm.org/mailman/listinfo/rpm-maint
