Re: [vserver] vnamespace mount -o remount,ro does not make it read-only

You can use the fstab file in the vserver config

An example: cat /etc/vservers/my-vserver/fstab
none /proc proc defaults 0 0
none /dev/pts devpts gid=5,mode=620 0 0
/shared/sites /sites none bind,rw 0 0
/shared/vhosts.d /etc/apache2/vhosts.d none bind,ro 0 0

Or you can mount them manually before the vserver starts
mount -o bind,rw /shared/sites /vservers/my-vserver/sites
mount -o bind,ro /shared/vhosts.d
/vservers/my-vserver/etc/apache2/vhosts.d

On 01/12/11 21:17, Christian Jaeger wrote:
> Hello,
>
> I want to bind mount a directory from the host (named 'tn') into a
> running vserver (named 't3'). I want the bind mount to be read-only.
> Yes I already know that mount --bind can't do them read-only
> immediately, so there will be a period during which the guest can
> write, but I can live with that right now. The real problem is that I
> can't manage to make the bind mount read-only at all.
>
> When I do the mounts from /etc/vservers/t3/fstab like with:
> /root/GIT /root/GIT none noatime,ro,bind 0 0
> they are correctly read-only. But when I try to do it manually, no go:
>
> First, to show that the commands work in the host context:
>
> tn:~# mount --bind ~chris/GIT/ /var/lib/vservers/t3/home/chris/GIT
> tn:~# touch /var/lib/vservers/t3/home/chris/GIT/fe
> tn:~# mount -o remount,ro /var/lib/vservers/t3/home/chris/GIT
> tn:~# touch /var/lib/vservers/t3/home/chris/GIT/fe
> touch: cannot touch `/var/lib/vservers/t3/home/chris/GIT/fe':
> Read-only file system
>
> i.e. as expected. Now,
>
> tn:~# vnamespace -e t3 mount --bind ~chris/GIT/
> /var/lib/vservers/t3/home/chris/GIT
> tn:~# vnamespace -e t3 mount -o remount,ro /var/lib/vservers/t3/home/chris/GIT
> tn:~# vnamespace -e t3 touch /var/lib/vservers/t3/home/chris/GIT/fe
> touch: cannot touch `/var/lib/vservers/t3/home/chris/GIT/fe':
> Read-only file system
>
> good, *but* this shows that the guest can still write there:
>
> chris@t3:~$ touch GIT/feh
> chris@t3:~$
>
> Why is this?
>
> Christian.

-- 
Sandino Araico Sánchez
http://sandino.net