On Wed, Oct 24, 2007 at 09:58:04PM -0400, Ryan Agler wrote:
> Hi,
>
> I am wondering how I can enable the host to view bind mounts
> made by a guest.
the guest uses separate namespaces by default, this
includes the vfs mount namespace, you have two options
here:
a) enter the namespace and look there
b) make the guest use the same namespace as the host
(not really suggested, security wise)
> It seems that currently I cannot see guest bind mounts form the
> host?
not in the 'default' namespace, but that is even true
for mounts done on the host (in a separate namespace)
(i.e. that is a mainline feature)
> For example:
>
> Guest# mkdir /bar
> Guest# mkdir /foo
> Guest# touch /foo/file
> Guest# mount --bind /foo /bar
> Guest# exit
> Host# ls /vservers/Guest/bar/file
> ls: /vservers/Guest/bar/file: No such file or directory
that is not just 'viewing' the mount, that is actually
_using_ that mount, and here you have three options
a) do the mount in the host too
b) enter the namespace of the guest (vnamespace)
c) share the same namespace with the guest
note that a simple clone call on the host or guest,
with the proper flags, can easily 'hide' a mount
from the other processes, so no guarantee that you
can always see and use the mounts done elsewhere
(this is not Linux-VServer specific!)
> I have tried adding ~HIDE_MOUNT to flags, with no result.
this only removes unrelated mounts in /proc/*/mounts
and has no effect on the filesystem namespace at all
> Any ideas?
> Thanks!
HTC,
Herbert
Received on Thu Oct 25 10:55:24 2007