Re: How does virsh lxc-enter-namespace work? Does it?

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Thu, Jun 06, 2013 at 09:13:27AM +0100, Daniel P. Berrange wrote:
> On Thu, Jun 06, 2013 at 10:07:26AM +0200, Richard Weinberger wrote:
> > I'm sure in my case setns() fails because the calling thread did not open() the ns files itself.
> 
> Do you have user namespaces enabled by chance ? 
> 
> > What is the plan to make lxc-enter-namespace work?
> > Privilege separation is nice but as of now the kernel interface (setns()) seems not to allow this.
> > Are you forcing the kernel guys to change the interface?
> 
> It has long worked fine on Fedora, though we do not have user namespaces
> enabled since parts of the kernel are yet to be ported to that (XFS in
> particular). My best guess is that user namespaces may have caused a
> regression in this ability to call setns() from a separate process.

The problem is actually that you're not allowed to call setns(fd) for a
fd which refers to your current namespace. The fd must refer to a different
namespace. Of course the code is opening the '/proc/$PID/ns/user' file
even though libvirt doesn't give the container a new user namespace. The
simplest fix is to just ignore EINVAL from setns(), since we can't easily
figure out if the calling apps' namespace matches the namespace of the
container.

Daniel
-- 
|: http://berrange.com      -o-    http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org              -o-             http://virt-manager.org :|
|: http://autobuild.org       -o-         http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org       -o-       http://live.gnome.org/gtk-vnc :|

--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list




[Index of Archives]     [Virt Tools]     [Libvirt Users]     [Lib OS Info]     [Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Big List of Linux Books]     [Yosemite News]     [KDE Users]     [Fedora Tools]