[vserver] vnamespace mount -o remount,ro does not make it read-only

From: Christian Jaeger <chrjae_at_gmail.com>
Date: Fri 02 Dec 2011 - 03:17:18 GMT
Message-ID: <CAEjYwfWgAGrJwGoChzosaMrp554AnqzaxV=XvssddScw6O74fQ@mail.gmail.com>

Hello,

I want to bind mount a directory from the host (named 'tn') into a
running vserver (named 't3'). I want the bind mount to be read-only.
Yes I already know that mount --bind can't do them read-only
immediately, so there will be a period during which the guest can
write, but I can live with that right now. The real problem is that I
can't manage to make the bind mount read-only at all.

When I do the mounts from /etc/vservers/t3/fstab like with:
/root/GIT /root/GIT none noatime,ro,bind 0 0
they are correctly read-only. But when I try to do it manually, no go:

First, to show that the commands work in the host context:

tn:~# mount --bind ~chris/GIT/ /var/lib/vservers/t3/home/chris/GIT
tn:~# touch /var/lib/vservers/t3/home/chris/GIT/fe
tn:~# mount -o remount,ro /var/lib/vservers/t3/home/chris/GIT
tn:~# touch /var/lib/vservers/t3/home/chris/GIT/fe
touch: cannot touch `/var/lib/vservers/t3/home/chris/GIT/fe':
Read-only file system

i.e. as expected. Now,

tn:~# vnamespace -e t3 mount --bind ~chris/GIT/
/var/lib/vservers/t3/home/chris/GIT
tn:~# vnamespace -e t3 mount -o remount,ro /var/lib/vservers/t3/home/chris/GIT
tn:~# vnamespace -e t3 touch /var/lib/vservers/t3/home/chris/GIT/fe
touch: cannot touch `/var/lib/vservers/t3/home/chris/GIT/fe':
Read-only file system

good, *but* this shows that the guest can still write there:

chris@t3:~$ touch GIT/feh
chris@t3:~$

Why is this?

Christian.
Received on Fri Dec 2 03:17:52 2011

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Fri 02 Dec 2011 - 03:17:53 GMT by hypermail 2.1.8