On Fri, May 22, 2015 at 10:39 AM, Eric W. Biederman
[off-list ref] wrote:
I had hoped to get some Tested-By's on that patch series.
Sorry, I've been totally swamped.
I suspect that Sandstorm is okay, but I haven't had a chance to test
it for real. Sandstorm makes only limited use of proc and sysfs in
containers, but I'll see if I can test it for real this weekend.
Oh well. The fundamentals seem sound, and my biggest concern the
implicit nodev does not apply so I will put this patchset in linux-next
and aim at merging it in the next merge window. Hopefully that will
leave enough time catch problems.
Eric
--
Andy Lutomirski
AMA Capital Management, LLC
Quoting Andy Lutomirski (luto@amacapital.net):
On Fri, May 22, 2015 at 10:39 AM, Eric W. Biederman
[off-list ref] wrote:
quoted
I had hoped to get some Tested-By's on that patch series.
Sorry, I've been totally swamped.
I suspect that Sandstorm is okay, but I haven't had a chance to test
it for real. Sandstorm makes only limited use of proc and sysfs in
containers, but I'll see if I can test it for real this weekend.
Testing this with unprivileged containers, I get
lxc-start: conf.c: lxc_mount_auto_mounts: 808 Operation not permitted - error mounting sysfs on /usr/lib/x86_64-linux-gnu/lxc/sys/devices/virtual/net flags 0
quoted
Oh well. The fundamentals seem sound, and my biggest concern the
implicit nodev does not apply so I will put this patchset in linux-next
and aim at merging it in the next merge window. Hopefully that will
leave enough time catch problems.
Eric
--
Andy Lutomirski
AMA Capital Management, LLC
_______________________________________________
Containers mailing list
Containers@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/containers
Am 28.05.2015 um 16:08 schrieb Serge Hallyn:
Quoting Andy Lutomirski (luto-kltTT9wpgjJwATOyAt5JVQ@public.gmane.org):
quoted
On Fri, May 22, 2015 at 10:39 AM, Eric W. Biederman
[off-list ref] wrote:
quoted
I had hoped to get some Tested-By's on that patch series.
Sorry, I've been totally swamped.
I suspect that Sandstorm is okay, but I haven't had a chance to test
it for real. Sandstorm makes only limited use of proc and sysfs in
containers, but I'll see if I can test it for real this weekend.
Testing this with unprivileged containers, I get
lxc-start: conf.c: lxc_mount_auto_mounts: 808 Operation not permitted - error mounting sysfs on /usr/lib/x86_64-linux-gnu/lxc/sys/devices/virtual/net flags 0
FWIW, it breaks also libvirt-lxc:
Error: internal error: guest failed to start: Failed to re-mount /proc/sys on /proc/sys flags=1021: Operation not permitted
Thanks,
//richard