W dniu 09.06.2011 16:46, Grzegorz Nosek pisze:
> Using ns_exec[1] -c -m (or ns_exec -m) also reports successful
> unshare/clone but changes to mounts remain visible.
BTW:
Running the same test from the host gives expected behaviour, i.e.
mounts changed from the shell spawned via ns_exec are not visible to
other processes.
VServer version is 2.6.35.8-vs2.3.0.36.33, util-vserver 0.30.216-pre2926.
BTW2: I'm not clear about how ccaps are supposed to work. I'd understand
that a guest without CAP_SYS_ADMIN but _with_ VXC_NAMESPACE should be
able to call unshare but apparently it isn't so (-EPERM). Or, if they
worked the other way around, CAP_SYS_ADMIN without VXC_NAMESPACE should
prevent unshare but does not. Am I missing something?
Best regards,
Grzegorz Nosek
Received on Thu Jun 9 16:30:17 2011