linux-kernel - Re: Question regarding container affecting the host system mounts

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CADFuHZ6c5p7opDgAoPc6oq8O6udSsFzW2VS721PNjoTh6v9D8g@mail.gmail.com>
Date:   Mon, 2 Apr 2018 10:40:48 -0500
From:   Ronak Desai <ronak.desai@...kwellcollins.com>
To:     linux-kernel@...r.kernel.org
Subject: Re: Question regarding container affecting the host system mounts

I am able to workaround this issue by marking the mount as unbinadable
and clearing the flag (CL_COPY_UNBINDABLE) in "copy_tree" function in
fs/namespace.c. This skips the unbindable mounts to get cloned inside
the new namespace. For my use-case this is acceptable.

On Thu, Mar 29, 2018 at 3:50 PM, Ronak Desai
<ronak.desai@...kwellcollins.com> wrote:
> I came across a problem where if the containers are running then it
> affects the unmount process of the system's mount points. I am not
> using these mount points as shared mounts with container.
>
> For example, I am using SD card and NAND as external storage device
> and mounting it to a mount point in the ramfs. Then I am launching
> containers and then when I try to unmount the NAND partition then my
> "unmount" call succeeds but I don't see the UBIFS hooks being called
> and because of that my UBI detach process fails. When I stopped the
> container then I see that kernel is calling the unmount as I see my
> debug prints inside the UBIFS for unmounting that partition.
>
> If I tried to mount my NAND partition once the container is up and try
> to unmount then it does unmount and detach without issue. It seems
> like there is an issue with namespace.
>
> I am using 4.1.8 kernel .  I traced the kernel code and I see that
> copy_mnt_ns is calling copy_tree and which basically increasing the
> active counts of the super block of my host mount points (NAND, SD cards).
> I am using container but I do not wish to share any of my host storage
> media with
> container so in my container configuration I am only mounting the
> tmpfs as the rootfs of container is in in tmpfs of host. But, still I
> can't umount completely my host storage media if containers are
> running.
>
> I have attached the log of the container start process with debugging
> and where you can see it is increasing the super block active counts
> for "ubifs".
>
> --
> Ronak A Desai
> Sr. Software Engineer
> Airborne Information Solutions / RC Linux Platform Software
> MS 131-100, C Ave NE, Cedar Rapids, IA, 52498, USA
>
> Ronak.Desai@...kwellcollins.com
>
> https://www.rockwellcollins.com/



-- 
Ronak A Desai
Sr. Software Engineer
Airborne Information Solutions / RC Linux Platform Software
MS 131-100, C Ave NE, Cedar Rapids, IA, 52498, USA

Phone : 319-263-2667 / VPN : 263-2667

Ronak.Desai@...kwellcollins.com

https://www.rockwellcollins.com/