Subject: Re: Nested mount namespaces
From: Grzegorz Nosek <grzegorz.nosek@gmail.com>
Date: Thu, 09 Jun 2011 17:30:05 +0200

W dniu 09.06.2011 16:46, Grzegorz Nosek pisze:
> Using ns_exec[1] -c -m (or ns_exec -m) also reports successful
> unshare/clone but changes to mounts remain visible.

BTW:

Running the same test from the host gives expected behaviour, i.e. 
mounts changed from the shell spawned via ns_exec are not visible to 
other processes.

VServer version is 2.6.35.8-vs2.3.0.36.33, util-vserver 0.30.216-pre2926.

BTW2: I'm not clear about how ccaps are supposed to work. I'd understand 
that a guest without CAP_SYS_ADMIN but _with_ VXC_NAMESPACE should be 
able to call unshare but apparently it isn't so (-EPERM). Or, if they 
worked the other way around, CAP_SYS_ADMIN without VXC_NAMESPACE should 
prevent unshare but does not. Am I missing something?

Best regards,
  Grzegorz Nosek