Bug#734813: systemd as pid1 allows lxc-containers to unmount host filesystems

2014-01-10 Thread Paul Tagliamonte
On Thu, Jan 09, 2014 at 11:17:25PM -0800, Josh Triplett wrote: > I also believe that preemptively CCing the tech-ctte on bugs like this > is a mistake I already talked with Mithrandir. He convinced me so already. Your comments are noted. Thanks, Paul -- .''`. Paul Tagliamonte | Proud De

Bug#734813: [Pkg-systemd-maintainers] Bug#734813: systemd as pid1 allows lxc-containers to unmount host filesystems

2014-01-10 Thread Paul Tagliamonte
forcemerge 734813 731574 thanks On Fri, Jan 10, 2014 at 08:08:18AM +0100, Michael Stapelberg wrote: > Hi Paul, Hey Michael :) > Paul Tagliamonte writes: > > A workaround was sent to me in a gist[2], but I've not tried it yet. > > Seems like it'd work. Another workaround given was to do: > > >

Bug#734813: systemd as pid1 allows lxc-containers to unmount host filesystems

2014-01-10 Thread Vincent Bernat
❦ 10 janvier 2014 09:05 CET, Alexander Larsson  : > I've added code to docker to handle / being shared, since fedora works > like that. It works by detecting a shared / and the starting lxc-start > in its own namespace where we've mounted / as rslave. See the code > here: > > https://github.com/d

Bug#734813: systemd as pid1 allows lxc-containers to unmount host filesystems

2014-01-10 Thread Alexander Larsson
I've added code to docker to handle / being shared, since fedora works like that. It works by detecting a shared / and the starting lxc-start in its own namespace where we've mounted / as rslave. See the code here: https://github.com/dotcloud/docker/blob/master/container.go#L673 This works out of

Bug#734813: systemd as pid1 allows lxc-containers to unmount host filesystems

2014-01-09 Thread Josh Triplett
Paul Tagliamonte wrote: > Once I was able to get a browser open, I found out olasd had researched > and found a commit[1] that seems to mark this as systemd's decision that > the kernel is wrong(?) > [1]: > http://cgit.freedesktop.org/systemd/systemd/commit/?id=b3ac5f8cb98757416d8660023d6564a7c41

Bug#734813: [Pkg-systemd-maintainers] Bug#734813: systemd as pid1 allows lxc-containers to unmount host filesystems

2014-01-09 Thread Michael Stapelberg
Hi Paul, Paul Tagliamonte writes: > A workaround was sent to me in a gist[2], but I've not tried it yet. > Seems like it'd work. Another workaround given was to do: > > for MNT in $(awk '{print $2}' /proc/mounts | sort -u) ; do > mount --make-rprivate $MNT; > done This needs to have #731574

Bug#734813: systemd as pid1 allows lxc-containers to unmount host filesystems

2014-01-09 Thread Jérôme Petazzoni
To clarify — the above-mentioned gist is not a workaround against the issue, but a sample snippet to repair my machine after it becomes unusable because of this bug. It's just remounting everything which was unmounted to make the machine usable again. It's (obviously) specific to my system, but it

Bug#734813: systemd as pid1 allows lxc-containers to unmount host filesystems

2014-01-09 Thread Paul Tagliamonte
Once I was able to get a browser open, I found out olasd had researched and found a commit[1] that seems to mark this as systemd's decision that the kernel is wrong(?) A workaround was sent to me in a gist[2], but I've not tried it yet. Seems like it'd work. Another workaround given was to do: f