> On March 31, 2016, 5:59 p.m., Cong Wang wrote:
> > Why /var/run/netns could be in the same mount peer group with its parent? At least
on fedora21 this is not the case.
> >
> > Also, why do you fix two bugs in one patch? I know you don't care about bisect,
but even so this is still not a good practice at all.
>
> Jie Yu wrote:
> I'll split the patch. Regarding the mount peer groups issue, here is the test I did
on fedora23:
> ```
> [vagrant@localhost build]$ cat /proc/self/mountinfo
> 17 58 0:17 / /sys rw,nosuid,nodev,noexec,relatime shared:6 - sysfs sysfs rw,seclabel
> 18 58 0:4 / /proc rw,nosuid,nodev,noexec,relatime shared:5 - proc proc rw
> 19 58 0:6 / /dev rw,nosuid shared:2 - devtmpfs devtmpfs rw,seclabel,size=4076012k,nr_inodes=1019003,mode=755
> 20 17 0:18 / /sys/kernel/security rw,nosuid,nodev,noexec,relatime shared:7 - securityfs
securityfs rw
> 21 19 0:19 / /dev/shm rw,nosuid,nodev shared:3 - tmpfs tmpfs rw,seclabel
> 22 19 0:13 / /dev/pts rw,nosuid,noexec,relatime shared:4 - devpts devpts rw,seclabel,gid=5,mode=620,ptmxmode=000
> 23 58 0:20 / /run rw,nosuid,nodev shared:22 - tmpfs tmpfs rw,seclabel,mode=755
> 24 17 0:21 / /sys/fs/cgroup ro,nosuid,nodev,noexec shared:8 - tmpfs tmpfs ro,seclabel,mode=755
> 25 24 0:22 / /sys/fs/cgroup/systemd rw,nosuid,nodev,noexec,relatime shared:9 - cgroup
cgroup rw,xattr,release_agent=/usr/lib/systemd/systemd-cgroups-agent,name=systemd
> 26 17 0:23 / /sys/fs/pstore rw,nosuid,nodev,noexec,relatime shared:19 - pstore pstore
rw,seclabel
> 27 24 0:24 / /sys/fs/cgroup/blkio rw,nosuid,nodev,noexec,relatime shared:10 - cgroup
cgroup rw,blkio
> 28 24 0:25 / /sys/fs/cgroup/net_cls,net_prio rw,nosuid,nodev,noexec,relatime shared:11
- cgroup cgroup rw,net_cls,net_prio
> 29 24 0:26 / /sys/fs/cgroup/freezer rw,nosuid,nodev,noexec,relatime shared:12 - cgroup
cgroup rw,freezer
> 30 24 0:27 / /sys/fs/cgroup/memory rw,nosuid,nodev,noexec,relatime shared:13 - cgroup
cgroup rw,memory
> 31 24 0:28 / /sys/fs/cgroup/perf_event rw,nosuid,nodev,noexec,relatime shared:14
- cgroup cgroup rw,perf_event
> 32 24 0:29 / /sys/fs/cgroup/cpu,cpuacct rw,nosuid,nodev,noexec,relatime shared:15
- cgroup cgroup rw,cpu,cpuacct
> 33 24 0:30 / /sys/fs/cgroup/devices rw,nosuid,nodev,noexec,relatime shared:16 - cgroup
cgroup rw,devices
> 34 24 0:31 / /sys/fs/cgroup/hugetlb rw,nosuid,nodev,noexec,relatime shared:17 - cgroup
cgroup rw,hugetlb
> 35 24 0:32 / /sys/fs/cgroup/cpuset rw,nosuid,nodev,noexec,relatime shared:18 - cgroup
cgroup rw,cpuset
> 56 17 0:33 / /sys/kernel/config rw,relatime shared:20 - configfs configfs rw
> 58 0 8:1 / / rw,relatime shared:1 - ext4 /dev/sda1 rw,seclabel,data=ordered
> 36 17 0:16 / /sys/fs/selinux rw,relatime shared:21 - selinuxfs selinuxfs rw
> 37 18 0:34 / /proc/sys/fs/binfmt_misc rw,relatime shared:23 - autofs systemd-1 rw,fd=30,pgrp=1,timeout=0,minproto=5,maxproto=5,direct
> 38 19 0:35 / /dev/hugepages rw,relatime shared:24 - hugetlbfs hugetlbfs rw,seclabel
> 39 19 0:15 / /dev/mqueue rw,relatime shared:25 - mqueue mqueue rw,seclabel
> 40 17 0:7 / /sys/kernel/debug rw,relatime shared:26 - debugfs debugfs rw,seclabel
> 70 23 0:36 / /run/user/1001 rw,nosuid,nodev,relatime shared:27 - tmpfs tmpfs rw,seclabel,size=817560k,mode=700,uid=1001,gid=1001
> [vagrant@localhost build]$ sudo mount^C
> [vagrant@localhost build]$ sudo mkdir /run/netns
> [vagrant@localhost build]$ sudo mount --bind /run/netns /run/netns
> [vagrant@localhost build]$ cat /proc/self/mountinfo
> 17 58 0:17 / /sys rw,nosuid,nodev,noexec,relatime shared:6 - sysfs sysfs rw,seclabel
> 18 58 0:4 / /proc rw,nosuid,nodev,noexec,relatime shared:5 - proc proc rw
> 19 58 0:6 / /dev rw,nosuid shared:2 - devtmpfs devtmpfs rw,seclabel,size=4076012k,nr_inodes=1019003,mode=755
> 20 17 0:18 / /sys/kernel/security rw,nosuid,nodev,noexec,relatime shared:7 - securityfs
securityfs rw
> 21 19 0:19 / /dev/shm rw,nosuid,nodev shared:3 - tmpfs tmpfs rw,seclabel
> 22 19 0:13 / /dev/pts rw,nosuid,noexec,relatime shared:4 - devpts devpts rw,seclabel,gid=5,mode=620,ptmxmode=000
> 23 58 0:20 / /run rw,nosuid,nodev shared:22 - tmpfs tmpfs rw,seclabel,mode=755
> 24 17 0:21 / /sys/fs/cgroup ro,nosuid,nodev,noexec shared:8 - tmpfs tmpfs ro,seclabel,mode=755
> 25 24 0:22 / /sys/fs/cgroup/systemd rw,nosuid,nodev,noexec,relatime shared:9 - cgroup
cgroup rw,xattr,release_agent=/usr/lib/systemd/systemd-cgroups-agent,name=systemd
> 26 17 0:23 / /sys/fs/pstore rw,nosuid,nodev,noexec,relatime shared:19 - pstore pstore
rw,seclabel
> 27 24 0:24 / /sys/fs/cgroup/blkio rw,nosuid,nodev,noexec,relatime shared:10 - cgroup
cgroup rw,blkio
> 28 24 0:25 / /sys/fs/cgroup/net_cls,net_prio rw,nosuid,nodev,noexec,relatime shared:11
- cgroup cgroup rw,net_cls,net_prio
> 29 24 0:26 / /sys/fs/cgroup/freezer rw,nosuid,nodev,noexec,relatime shared:12 - cgroup
cgroup rw,freezer
> 30 24 0:27 / /sys/fs/cgroup/memory rw,nosuid,nodev,noexec,relatime shared:13 - cgroup
cgroup rw,memory
> 31 24 0:28 / /sys/fs/cgroup/perf_event rw,nosuid,nodev,noexec,relatime shared:14
- cgroup cgroup rw,perf_event
> 32 24 0:29 / /sys/fs/cgroup/cpu,cpuacct rw,nosuid,nodev,noexec,relatime shared:15
- cgroup cgroup rw,cpu,cpuacct
> 33 24 0:30 / /sys/fs/cgroup/devices rw,nosuid,nodev,noexec,relatime shared:16 - cgroup
cgroup rw,devices
> 34 24 0:31 / /sys/fs/cgroup/hugetlb rw,nosuid,nodev,noexec,relatime shared:17 - cgroup
cgroup rw,hugetlb
> 35 24 0:32 / /sys/fs/cgroup/cpuset rw,nosuid,nodev,noexec,relatime shared:18 - cgroup
cgroup rw,cpuset
> 56 17 0:33 / /sys/kernel/config rw,relatime shared:20 - configfs configfs rw
> 58 0 8:1 / / rw,relatime shared:1 - ext4 /dev/sda1 rw,seclabel,data=ordered
> 36 17 0:16 / /sys/fs/selinux rw,relatime shared:21 - selinuxfs selinuxfs rw
> 37 18 0:34 / /proc/sys/fs/binfmt_misc rw,relatime shared:23 - autofs systemd-1 rw,fd=30,pgrp=1,timeout=0,minproto=5,maxproto=5,direct
> 38 19 0:35 / /dev/hugepages rw,relatime shared:24 - hugetlbfs hugetlbfs rw,seclabel
> 39 19 0:15 / /dev/mqueue rw,relatime shared:25 - mqueue mqueue rw,seclabel
> 40 17 0:7 / /sys/kernel/debug rw,relatime shared:26 - debugfs debugfs rw,seclabel
> 70 23 0:36 / /run/user/1001 rw,nosuid,nodev,relatime shared:27 - tmpfs tmpfs rw,seclabel,size=817560k,mode=700,uid=1001,gid=1001
> 72 23 0:20 /netns /run/netns rw,nosuid,nodev shared:22 - tmpfs tmpfs rw,seclabel,mode=755
> [vagrant@localhost build]$ sudo mount --make-shared /run/netns
> [vagrant@localhost build]$ cat /proc/self/mountinfo
> 17 58 0:17 / /sys rw,nosuid,nodev,noexec,relatime shared:6 - sysfs sysfs rw,seclabel
> 18 58 0:4 / /proc rw,nosuid,nodev,noexec,relatime shared:5 - proc proc rw
> 19 58 0:6 / /dev rw,nosuid shared:2 - devtmpfs devtmpfs rw,seclabel,size=4076012k,nr_inodes=1019003,mode=755
> 20 17 0:18 / /sys/kernel/security rw,nosuid,nodev,noexec,relatime shared:7 - securityfs
securityfs rw
> 21 19 0:19 / /dev/shm rw,nosuid,nodev shared:3 - tmpfs tmpfs rw,seclabel
> 22 19 0:13 / /dev/pts rw,nosuid,noexec,relatime shared:4 - devpts devpts rw,seclabel,gid=5,mode=620,ptmxmode=000
> 23 58 0:20 / /run rw,nosuid,nodev shared:22 - tmpfs tmpfs rw,seclabel,mode=755
> 24 17 0:21 / /sys/fs/cgroup ro,nosuid,nodev,noexec shared:8 - tmpfs tmpfs ro,seclabel,mode=755
> 25 24 0:22 / /sys/fs/cgroup/systemd rw,nosuid,nodev,noexec,relatime shared:9 - cgroup
cgroup rw,xattr,release_agent=/usr/lib/systemd/systemd-cgroups-agent,name=systemd
> 26 17 0:23 / /sys/fs/pstore rw,nosuid,nodev,noexec,relatime shared:19 - pstore pstore
rw,seclabel
> 27 24 0:24 / /sys/fs/cgroup/blkio rw,nosuid,nodev,noexec,relatime shared:10 - cgroup
cgroup rw,blkio
> 28 24 0:25 / /sys/fs/cgroup/net_cls,net_prio rw,nosuid,nodev,noexec,relatime shared:11
- cgroup cgroup rw,net_cls,net_prio
> 29 24 0:26 / /sys/fs/cgroup/freezer rw,nosuid,nodev,noexec,relatime shared:12 - cgroup
cgroup rw,freezer
> 30 24 0:27 / /sys/fs/cgroup/memory rw,nosuid,nodev,noexec,relatime shared:13 - cgroup
cgroup rw,memory
> 31 24 0:28 / /sys/fs/cgroup/perf_event rw,nosuid,nodev,noexec,relatime shared:14
- cgroup cgroup rw,perf_event
> 32 24 0:29 / /sys/fs/cgroup/cpu,cpuacct rw,nosuid,nodev,noexec,relatime shared:15
- cgroup cgroup rw,cpu,cpuacct
> 33 24 0:30 / /sys/fs/cgroup/devices rw,nosuid,nodev,noexec,relatime shared:16 - cgroup
cgroup rw,devices
> 34 24 0:31 / /sys/fs/cgroup/hugetlb rw,nosuid,nodev,noexec,relatime shared:17 - cgroup
cgroup rw,hugetlb
> 35 24 0:32 / /sys/fs/cgroup/cpuset rw,nosuid,nodev,noexec,relatime shared:18 - cgroup
cgroup rw,cpuset
> 56 17 0:33 / /sys/kernel/config rw,relatime shared:20 - configfs configfs rw
> 58 0 8:1 / / rw,relatime shared:1 - ext4 /dev/sda1 rw,seclabel,data=ordered
> 36 17 0:16 / /sys/fs/selinux rw,relatime shared:21 - selinuxfs selinuxfs rw
> 37 18 0:34 / /proc/sys/fs/binfmt_misc rw,relatime shared:23 - autofs systemd-1 rw,fd=30,pgrp=1,timeout=0,minproto=5,maxproto=5,direct
> 38 19 0:35 / /dev/hugepages rw,relatime shared:24 - hugetlbfs hugetlbfs rw,seclabel
> 39 19 0:15 / /dev/mqueue rw,relatime shared:25 - mqueue mqueue rw,seclabel
> 40 17 0:7 / /sys/kernel/debug rw,relatime shared:26 - debugfs debugfs rw,seclabel
> 70 23 0:36 / /run/user/1001 rw,nosuid,nodev,relatime shared:27 - tmpfs tmpfs rw,seclabel,size=817560k,mode=700,uid=1001,gid=1001
> 72 23 0:20 /netns /run/netns rw,nosuid,nodev shared:22 - tmpfs tmpfs rw,seclabel,mode=755
> ```
>
> Cong Wang wrote:
> My point is who makes the peer group change? Is that the distro? If not, admin/user
can always do whatever they want, it doesn't make much sense to fix a user-spefic case. If
it is distro, we have to fix it, like the symlink case.
yeah, different linux distro has different default.
On centos7/fedora23, '/' (and all other default mounts) are shared mounts
on Ubuntu14.04, '/' (and all other default mounts) are private mounts
- Jie
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/45520/#review126372
-----------------------------------------------------------
On March 31, 2016, 1:47 a.m., Jie Yu wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/45520/
> -----------------------------------------------------------
>
> (Updated March 31, 2016, 1:47 a.m.)
>
>
> Review request for mesos, Ian Downes and Cong Wang.
>
>
> Bugs: MESOS-4662
> https://issues.apache.org/jira/browse/MESOS-4662
>
>
> Repository: mesos
>
>
> Description
> -------
>
> Fixed the bind mount root issue in port mapping isolator. This patch fixed two issues:
> 1) no long assume /var/run/netns is a realpath
> 2) made sure /var/run/netns is a shared mount in its own mount peer group
>
>
> Diffs
> -----
>
> src/slave/containerizer/mesos/isolators/network/port_mapping.hpp 0fe2f486eb733acf738c1c61fc44f820d7401afc
> src/slave/containerizer/mesos/isolators/network/port_mapping.cpp 323c84a3d960a196d8ba87f753814e9d43a07957
> src/tests/containerizer/port_mapping_tests.cpp e062daa9fcfc776144b48325daa1f1284c5e59a4
>
> Diff: https://reviews.apache.org/r/45520/diff/
>
>
> Testing
> -------
>
> sudo make check on Fedora23
>
>
> Thanks,
>
> Jie Yu
>
>
|