Subject: Re: [vserver] fusermount -u fails
From: Wilhelm <wilhelm.meier@fh-kl.de>
Date: Tue, 02 Mar 2010 21:23:58 +0100

Herbert Poetzl schrieb:
> On Tue, Mar 02, 2010 at 12:02:16AM -0500, John A. Sullivan III wrote:
>   
>> Hello, all.  I'm struggling to get sshfs working in a vserver for use
>> with X2Go (www.x2go.org).  I am running kernel 2.6.28.7 with
>> vs2.3.0.36.7 on CentOS 5.4 with a Debian Lenny guest.  
>>     
>
> I'd suggest to try with a more recent kernel, also
> make sure that you have recent enough util-vserver
> (i.e. not 0.30.215)
>   
get a newer util-vserver from:

http://people.linux-vserver.org/~dhozac/t/uv-testing/

(newer than or equal to pre2878, look for

#define VC_VXC_NAMESPACE               0x02000000ull

in ./lib/vserver.h)

>   
>> I am able to mount the sshfs file system but I am not able to do an
>> fusermount -u.
>> It returns:
>>     
>
>   
>> fusermount: failed to clone namespace: Operation not permitted
>>     
>
> strace -fF of the command in question might sched
> some light on it ...
>
>   
>> Current ccapabilities are:
>> SECURE_MOUNT
>> SECURE_REMOUNT
>> BINARY_MOUNT
>>     
>
>   
>> The user attempting to do the fusermount -u is a member of fuse group
>> which has rw access to /dev/fuse.
>>     
>
>   
>> How do I get this to work?
>>     
>
>   
>> Just for kicks I tried adding the NAMESPACE ccapability but vserver
>> complains Unknown ccap 'NAMESPACE' - not that I really understand what
>> that capability would do :-(
>>     
>
>   
>> I tried setting setgid on fusermount; that didn't work.  Since it is
>> already setuid, I thought I'd add the SETUID capability:
>> vattribute --xid 40061 --bcap SETUID
>> but got the same error.
>>     
>
>   
>> For kicks, I added SYS_ADMIN and received a different error:
>> fusermount: failed to mark mounts slave: Invalid argument
>>     
>
> sounds interesting ...
>
>   
>> Of course, I certainly don't want to grant SYS_ADMIN. Any help would
>> be greatly appreciated. X2Go is working generally well in a vserver
>> but it cannot clean up after itself if I don't solve this. 
>> Thanks - John
>>     
>
> best,
> Herbert
>
>   


-- 
Wilhelm