On 12/21/2014 08:57 PM, Chen Hanxiao wrote: s/namespce/namespace/ in the subject line > If we enabled user ns and provided a uid/gid map, > we do not need to mount /proc, /sys as readonly. > Leave it to kernel for protection. > > Signed-off-by: Chen Hanxiao <chenhanxiao(a)cn.fujitsu.com&gt; > --- > src/lxc/lxc_container.c | 6 ++++++ > 1 file changed, 6 insertions(+) I'll leave the actual patch review to someone more familiar with LXC namespace setups

> -----Original Message----- > From: Richard Weinberger [mailto:richard.weinberger@gmail.com] > Sent: Wednesday, December 24, 2014 5:36 AM > To: Eric Blake > Cc: Chen, Hanxiao/陈 晗霄; libvir-list(a)redhat.com > Subject: Re: [libvirt] [PATCH RFC] LXC: don't RO mount /proc, /sys when user > namespce enabled > > On Mon, Dec 22, 2014 at 4:12 PM, Eric Blake <eblake(a)redhat.com&gt; wrote: >> On 12/21/2014 08:57 PM, Chen Hanxiao wrote: >> >> s/namespce/namespace/ in the subject line >> >>> If we enabled user ns and provided a uid/gid map, >>> we do not need to mount /proc, /sys as readonly. >>> Leave it to kernel for protection. >>> >>> Signed-off-by: Chen Hanxiao <chenhanxiao(a)cn.fujitsu.com&gt; >>> --- >>> src/lxc/lxc_container.c | 6 ++++++ >>> 1 file changed, 6 insertions(+) >> >> I'll leave the actual patch review to someone more familiar with LXC >> namespace setups > > This change will still mount some useless stuff like: > { "/.oldroot/proc/sys/net/ipv4", "/proc/sys/net/ipv4", NULL, > MS_BIND, false, false, true }, > { "/.oldroot/proc/sys/net/ipv6", "/proc/sys/net/ipv6", NULL, > MS_BIND, false, false, true }, > > You can set skipUserNS for these. Thanks, I didn't notice that. > > But I *really* would like to see /proc and /sys mounted RW as default. > Please see my comment to: > [libvirt] [PATCHv3] lxc: give RW access to /proc/sys/net/ipv[46] to containers I see your new comments in that thread. If libvirt enable userns(provided a uid/gid map in XML), it's safe to drop RO mount completely; If not, I'm not sure whether it will bring back compatibility issues. So let's wait for more comments from maintainers.