On Sun, Feb 22, 2015 at 04:50:00PM +0100, Oliver Welter wrote: > Am 22.02.2015 um 15:50 schrieb Oliver Welter: >> Hi Bertl, >> Am 02.02.2015 um 11:11 schrieb Herbert Poetzl: >>> On Mon, Feb 02, 2015 at 08:10:15AM +0100, Oliver Welter wrote: >>>> Am 02.02.2015 um 01:58 schrieb Herbert Poetzl: >>>>> On Sun, Feb 01, 2015 at 03:28:22PM +0100, Oliver Welter wrote: >>>>>> Trying the same without starting the vserver, using a simple >>>>>> "chroot" works, so it looks like some limits are not working >>>>>> correctly. >>>>> Please try without Linux-VServer isolation but with the same >>>>> namespace setup, I don't think that you are hitting a limit >>>>> here, it looks more like a namespace problem of overlayfs. >>>> Can you be a bit more verbose - I never git in touch with the >>>> individual components ;) >>> Either use vnamespace or the unshare tool to create a namespace >>> setup identical to your guest and check if the issue remains. >> I am unable to reproduce it with vnamespace or unshare, I used attached >> test script and ran it as: >> vnamespace -n /mnt/test.sh >> vcontext --create --xid 42 /mnt/test.sh >> unshare -i -m -u test.sh >> with the correct result (file breakme is replaced by a >> directory on the common mount). >> When you do the same inside a vserver, it does not work (use >> overlay to assemble rootfs of vserver, start vserver, try to >> change entity which exists on the lower but not on the upper >> fs). > I think I got the root cause - overlayfs uses character files > to mark whiteouts and the vserver env seems to refuse access > to this whiteout file. Not sure what that means? If overlayfs uses special device files, you might want to create them for the guest and/or allow them in the device mapper. > Adding SYS_ADMIN "makes it work", so I guess the right way > would be to skip the access check for overlayfs whiteouts. Documentation says it should be a character device with major/minor 0/0, so allowing that device should do the job, no further modification required. All the best, Herbert > Oli > -- > Protect your environment - close windows and adopt a penguin!