Am 24.12.2014 um 03:23 schrieb Chen, Hanxiao: > > >> -----Original Message----- >> From: Richard Weinberger [mailto:richard.weinberger@xxxxxxxxx] >> Sent: Wednesday, December 24, 2014 5:36 AM >> To: Eric Blake >> Cc: Chen, Hanxiao/陈 晗霄; libvir-list@xxxxxxxxxx >> Subject: Re: [PATCH RFC] LXC: don't RO mount /proc, /sys when user >> namespce enabled >> >> On Mon, Dec 22, 2014 at 4:12 PM, Eric Blake <eblake@xxxxxxxxxx> wrote: >>> On 12/21/2014 08:57 PM, Chen Hanxiao wrote: >>> >>> s/namespce/namespace/ in the subject line >>> >>>> If we enabled user ns and provided a uid/gid map, >>>> we do not need to mount /proc, /sys as readonly. >>>> Leave it to kernel for protection. >>>> >>>> Signed-off-by: Chen Hanxiao <chenhanxiao@xxxxxxxxxxxxxx> >>>> --- >>>> src/lxc/lxc_container.c | 6 ++++++ >>>> 1 file changed, 6 insertions(+) >>> >>> I'll leave the actual patch review to someone more familiar with LXC >>> namespace setups >> >> This change will still mount some useless stuff like: >> { "/.oldroot/proc/sys/net/ipv4", "/proc/sys/net/ipv4", NULL, >> MS_BIND, false, false, true }, >> { "/.oldroot/proc/sys/net/ipv6", "/proc/sys/net/ipv6", NULL, >> MS_BIND, false, false, true }, >> >> You can set skipUserNS for these. > > Thanks, I didn't notice that. > >> >> But I *really* would like to see /proc and /sys mounted RW as default. >> Please see my comment to: >> [PATCHv3] lxc: give RW access to /proc/sys/net/ipv[46] to containers > > I see your new comments in that thread. > If libvirt enable userns(provided a uid/gid map in XML), > it's safe to drop RO mount completely; > If not, I'm not sure whether it will bring back compatibility issues. > > So let's wait for more comments from maintainers. I Agree Thanks, //richard -- libvir-list mailing list libvir-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/libvir-list