On 11/16/2013 12:24 AM, Daniel P. Berrange wrote: > On Thu, Nov 14, 2013 at 05:44:40PM +0800, Chen Hanxiao wrote: >> >> >>> -----Original Message----- >>> From: Daniel P. Berrange [mailto:berrange@xxxxxxxxxx] >>> Sent: Wednesday, November 13, 2013 6:35 PM >>> To: Chen Hanxiao >>> Cc: libvir-list@xxxxxxxxxx >>> Subject: Re: [PATCH v2]lxc: don't mount dir if ownership couldn't be >>> known >>> >>> On Wed, Nov 13, 2013 at 04:51:43PM +0800, Chen Hanxiao wrote: >>>> From: Chen Hanxiao <chenhanxiao@xxxxxxxxxxxxxx> >>>> >>>> If we enable userns, we could bind mount >>>> some dirs from host to guest, which don't belong to >>>> the target mapped uid/gid. >>>> >>>> Such as we could bind mount root's dirs to guest. >>>> What is worse, we could even modify root's files >>>> in that bind dir inside container. >>> >>> I still can't see what the problem is from the description >>> here. Please can you give a clear example of the config >>> used and exactly what goes wrong. >>> >> >> 1. enable user namespace >> <idmap> >> <uid start='0' target='1001' count='10'/> >> <gid start='0' target='1001' count='10'/> >> </idmap> >> >> 2. bind mount some dirs to container, which belongs to root or other users. >> <filesystem type='mount' accessmode='passthrough'> >> <source dir='/media/LXC1'/> >> <target dir='/mnt'/> >> </filesystem> >> >> # ll /media/ >> ... >> drwxr-xr-x. 3 root root 4096 Nov 13 17:21 LXC1 >> ... >> >> 3. start container >> >> I used to encounter issues: inside container, we could modify files under /mnt >> >> So I think inside user namespace, if we do not have a proper id mapping, >> we should not bind mount it for containers, or at least set it as readonly. > > FYI, I'm trying to reproduce the problem myself, but have discovered > that current kernels cause a regression which prevents libirt starting > any user namespace kernels - it fails mounting /proc and /dev/pts > FYI,I'm working on fix this bug. both kernel and libvirt need to be changed. -- libvir-list mailing list libvir-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/libvir-list