Why is the Linux command `unshare --pid=p --mount=m` not creating a persistent namespace?
2
votes
2
answers
952
views
From everything I have read in the
unshare
and nsenter
man pages, I should be able to bind-mount a directory to itself, mount --make-private
the directory, and then use files within that directory to hold refs for persistent namespaces. Here is what I'm doing, basically the same as the man unshare
but with different directories and using --pid=file
in addition to --mount=file
# Terminal 1:
# mkdir -p /mnt/jails/debian/bookworm/.ns
# mount --bind /mnt/jails/debian/bookworm/.ns /mnt/jails/debian/bookworm/.ns
# touch /mnt/jails/debian/bookworm/.ns/{mount,pid}
# mount --make-private /mnt/jails/debian/bookworm/.ns
# unshare --fork --mount-proc --mount=/mnt/jails/debian/bookworm/.ns/mount --pid=/mnt/jails/debian/bookworm/.ns/pid /bin/sh & echo $!; fg
151299
151299
sh-4.4# echo $$
1
sh-4.4# grep NS /proc/self/status
NStgid: 3
NSpid: 3
NSpgid: 3
NSsid: 0
So far so good, the container above is working. While that runs:
# Terminal 2:
# nsenter --mount=/mnt/jails/debian/bookworm/.ns/mount --pid=/mnt/jails/debian/bookworm/.ns/pid /bin/sh
sh-4.4# ps ax
Error, do this: mount -t proc proc /proc
# ls /proc/1/exe -l
lrwxrwxrwx. 1 root root 0 Jul 21 18:49 /proc/1/exe -> /usr/bin/bash
sh-4.4# mount -t proc proc /proc
sh-4.4# ps ax|head
sh-4.4# grep NS /proc/self/status
NStgid: 156987
NSpid: 156987
NSpgid: 156987
NSsid: 156921
I've also tried this in Terminal 2 (note the pid from Terminal 1) with the exact same results:
# nsenter -t 151299 -a /bin/sh
sh-4.4# ps ax
Error, do this: mount -t proc proc /proc
# ls /proc/1/exe -l
lrwxrwxrwx. 1 root root 0 Jul 21 18:49 /proc/1/exe -> /usr/bin/bash
sh-4.4# mount -t proc proc /proc
sh-4.4# ps ax|head
sh-4.4# grep NS /proc/self/status
NStgid: 155356
NSpid: 155356
NSpgid: 155356
NSsid: 143538
For some reason nsenter
is entering the host OS's pid space, however it does seem to see a the namespace of the correct /proc directory, but it is invalid for sh
in terminal2 because the pid namespace isn't working so (I think) thats why ps ax
gives an error. Also I've tried both with and without --mount-proc
# Questions:
How can I enter the PID namespace from Terminal 1?
What am I doing wrong here?
(Host linux kernel is 5.18 running Oracle Linux 8.)
Asked by KJ7LNW
(525 rep)
Jul 22, 2022, 02:03 AM
Last activity: Jul 25, 2022, 06:07 AM
Last activity: Jul 25, 2022, 06:07 AM