Mounting block device fails when CLONE_NEWUSER

[yadutaf]

When using an lxc.id_map any lxc.mount.entry entry involving a block device will fail. tmpfs, procfs, bind mounts work as expected.

A workaround is to:

1. Mount bdev in host namespace
2. Mount bind host-->container
3. Umount bdev from host

I suspect this is caused by CLONE_NEWUSER being used in clone too early (before mount). An option I see could be to unshare(CLONE_NEWUSER) after mounts are all done then signal parent process to setup required id_map or split lxc_setup in 2 distinct parts, the first running outside this namespace. What do think of this approach ?

For the time being, I use the workaround but I hope to have some time to hack something into LXC itself in the coming weeks.

[hallyn]

The constraints are: (1) an unprivileged user must unshare userns before he can unshare mntns. (2) when the container goes away - even uncleanly - the mount must go away.

I think the cleanest way to do this in the code (which is still not as clean as I'd like) would be to handle this right after src/lxc/start.c's call to attach_block_device(). Check whether getuid() == 0 and lxc.id_map is not empty. If that is the case, then unshare a mnt_ns right there, mount the block device to $lxcpath/$lxc_name/rootfs, and update the lxc_conf->rootfs.path to be $lxcpath/$lxc_name/rootfs.

Based on your last paragraph, I gather you're interested in coding up a patch for this, so I'll wait for that. (If that's not the case please let me know)

[yadutaf]

I'd be tempted to keep the mounts where they are currently and, if id_map is not empty and getuid() == 0 then unshare at this point and signal the parent process to setup the id_map. This way, we keep the same workflow. Obviously, if the user is not root, we don't change anything. Would it be cleaner ?

I will submit a patch next week.

[hallyn]

I don't believe it is possible to do this and have it work for
unprivileged users. However if you can make it work and the patch
is clean, all the better :)

[hallyn]

This is needed for another driver to create qcow2-based unprivileged containers, so I am going to post a patch tonight for this. If you come up with a cleaner patch later on we'll happily take a look.

[yadutaf]

I have a proof of concept on my side that works for both lxc.rootfs and lxc.mount.entry while preserving current behavior for non-root containers. The only problem is that it will most probably conflict with commit 35120d9. I'll keep you informed as soon as possible.