Re: [libvirt] [PATCH] Mount fresh instance of sysfs in LXC

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 05/10/2012 04:25 PM, Eric Blake wrote: > On 05/10/2012 10:17 AM, Daniel P. Berrange wrote: >> From: "Daniel P. Berrange" <berrange(a)redhat.com&gt; >> >> Currently to make sysfs readonly, we remount the existing instance and >> then bind it readonly. Unfortunately this means sysfs is still showing >> device objects wrt the host OS namespace. We need it to reflect the >> container namespace, so we must mount a completely new instance of it. >> >> * src/lxc/lxc_container.c: Mount fresh sysfs instance --- >> src/lxc/lxc_container.c | 3 +-- 1 file changed, 1 insertion(+), 2 >> deletions(-) >> >> diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c index >> b953646..77d33e1 100644 --- a/src/lxc/lxc_container.c +++ >> b/src/lxc/lxc_container.c @@ -441,8 +441,7 @@ static int >> lxcContainerMountBasicFS(lxc_child_argv_t *argv, const char *srcprefi { >> false, "proc", "/proc", "proc", NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV }, { >> false, "/proc/sys", "/proc/sys", NULL, NULL, MS_BIND }, { false, >> "/proc/sys", "/proc/sys", NULL, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY }, - >> { true, "/sys", "/sys", NULL, NULL, MS_BIND }, - { true, "/sys", >> "/sys", NULL, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY }, + { false, >> "sysfs", "/sys", "sysfs", NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_RDONLY >> }, > > ACK. > I have been testing this and it is working correctly now.