On Mon, Dec 22, 2014 at 4:12 PM, Eric Blake <eblake@redhat.com> wrote:
On 12/21/2014 08:57 PM, Chen Hanxiao wrote:
s/namespce/namespace/ in the subject line
If we enabled user ns and provided a uid/gid map, we do not need to mount /proc, /sys as readonly. Leave it to kernel for protection.
Signed-off-by: Chen Hanxiao <chenhanxiao@cn.fujitsu.com> --- src/lxc/lxc_container.c | 6 ++++++ 1 file changed, 6 insertions(+)
I'll leave the actual patch review to someone more familiar with LXC namespace setups
This change will still mount some useless stuff like: { "/.oldroot/proc/sys/net/ipv4", "/proc/sys/net/ipv4", NULL, MS_BIND, false, false, true }, { "/.oldroot/proc/sys/net/ipv6", "/proc/sys/net/ipv6", NULL, MS_BIND, false, false, true }, You can set skipUserNS for these. But I *really* would like to see /proc and /sys mounted RW as default. Please see my comment to: [libvirt] [PATCHv3] lxc: give RW access to /proc/sys/net/ipv[46] to containers -- Thanks, //richard