[vserver] Re: Nested mount namespaces

From: Grzegorz Nosek <grzegorz.nosek_at_gmail.com>
Date: Thu 09 Jun 2011 - 16:30:05 BST
Message-ID: <4DF0E6FD.7030806@gmail.com>

W dniu 09.06.2011 16:46, Grzegorz Nosek pisze:
> Using ns_exec[1] -c -m (or ns_exec -m) also reports successful
> unshare/clone but changes to mounts remain visible.

BTW:

Running the same test from the host gives expected behaviour, i.e.
mounts changed from the shell spawned via ns_exec are not visible to
other processes.

VServer version is 2.6.35.8-vs2.3.0.36.33, util-vserver 0.30.216-pre2926.

BTW2: I'm not clear about how ccaps are supposed to work. I'd understand
that a guest without CAP_SYS_ADMIN but _with_ VXC_NAMESPACE should be
able to call unshare but apparently it isn't so (-EPERM). Or, if they
worked the other way around, CAP_SYS_ADMIN without VXC_NAMESPACE should
prevent unshare but does not. Am I missing something?

Best regards,
  Grzegorz Nosek
Received on Thu Jun 9 16:30:17 2011

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Thu 09 Jun 2011 - 16:30:17 BST by hypermail 2.1.8