On Thu, May 10, 2012 at 04:41:49PM -0400, Daniel J Walsh wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 05/10/2012 04:25 PM, Eric Blake wrote:
> > On 05/10/2012 10:17 AM, Daniel P. Berrange wrote:
> >> From: "Daniel P. Berrange" <berra...@redhat.com>
> >>
> >> Currently to make sysfs readonly, we remount the existing instance and
> >> then bind it readonly. Unfortunately this means sysfs is still showing
> >> device objects wrt the host OS namespace. We need it to reflect the
> >> container namespace, so we must mount a completely new instance of it.
> >>
> >> * src/lxc/lxc_container.c: Mount fresh sysfs instance ---
> >> src/lxc/lxc_container.c | 3 +-- 1 file changed, 1 insertion(+), 2
> >> deletions(-)
> >>
> >> diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c index
> >> b953646..77d33e1 100644 --- a/src/lxc/lxc_container.c +++
> >> b/src/lxc/lxc_container.c @@ -441,8 +441,7 @@ static int
> >> lxcContainerMountBasicFS(lxc_child_argv_t *argv, const char *srcprefi {
> >> false, "proc", "/proc", "proc", NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV }, {
> >> false, "/proc/sys", "/proc/sys", NULL, NULL, MS_BIND }, { false,
> >> "/proc/sys", "/proc/sys", NULL, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY }, -
> >> { true, "/sys", "/sys", NULL, NULL, MS_BIND }, - { true, "/sys",
> >> "/sys", NULL, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY }, + { false,
> >> "sysfs", "/sys", "sysfs", NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_RDONLY
> >> },
> >
> > ACK.
> >
> I have been testing this and it is working correctly now.
While this works fine, I withdraw it in favour of a more complete
patch posted in this series
https://www.redhat.com/archives/libvir-list/2012-May/msg00671.html
Daniel
--
|: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org -o- http://virt-manager.org :|
|: http://autobuild.org -o- http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|
--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list
