Date: Sun, 6 Mar 2016 02:28:20 -0600
From: "Serge E. Hallyn" <serge.hallyn@ubuntu.com>
To: "Eric W. Biederman" <ebiederm@xmission.com>,
        lkml <linux-kernel@vger.kernel.org>,
        Seth Forshee <seth.forshee@canonical.com>,
        =?iso-8859-1?Q?St=E9phane?= Graber <stgraber@ubuntu.com>,
        serge@hallyn.com, Andy Lutomirski <luto@amacapital.net>
Subject: user namespace and fully visible proc and sys mounts
Message-ID: <20160306082820.GA1917@mail.hallyn.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.5.21 (2010-09-15)
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 955
Lines: 22

Hi,

So we've been over this many times...  but unfortunately there is more
breakage to report.  Regular privileged and unprivileged containers
work all right for us.  But running an unprivileged container inside a
privileged container is blocked.

When creating privileged containers, lxc by default does a few things:
it mounts some fuse.lxcfs files over procfiles include /proc/meminfo and
/proc/uptime.  It mounts proc rw but /proc/sysrq-trigger ro as well as
moves /proc/sys/net out of the way, bind-mounts /proc/sys readonly
(because this container is not in a user namespace) then moves
/proc/sys/net back.  Finally it mounts sys ro but bind-mounts
/sys/devices/virtual/net as writeable.

If any of these are left enabled, unprivileged containers can't be
started.  If all are disabled, then they can be.

Can we find a way to make these not block remounts in child user
namespaces?  A boot flag, a procfs and sysfs mount option, a sysctl?

-serge