Subject: Re: [vserver] mounting glusterfs inside of vservers
From: Herbert Poetzl <herbert@13thfloor.at>
Date: Thu, 28 Aug 2008 10:48:00 +0200

On Wed, Aug 27, 2008 at 03:57:39PM -0700, Martin Fick wrote:
> --- On Wed, 8/27/08, Cedric Veilleux <cveilleux@neopeak.com> wrote:
> 
> [Sorry if the email is similar to another one I may or 
> may not have sent, I thought I did, but I don't see it]

> > Have you read:
> > 
> > http://linux-vserver.org/Fuse_GlusterFS

> No I hadn't seen that, nice, thanks.

> > The tutorial does not use fstab but simple starts the
> > gluster client from command line:

> > glusterfs -f /etc/glusterfs/glusterfs-client.vol
> > /mnt/glusterfs

> > you do need to give the guest proper capabilities and
> > device nodes. Read the rest of the page first.

I think it should suffice to have them on guest
startup (and maybe shutdown) to do that _for_ the
guest

> This will not work for me, there's no way I am willing 
> to give my guests mount privileges. 

and that is a good decision :)

> This brings up a somewhat sore point for me, it seems 
> logical to want to limit the ability to mount remote 
> filesystems independently from local filesystems. 

that's why Linux-VServer knows three different
mount related ccapabilities (SECURE_MOUNT,
SECURE_REMOUNT and BINARY_MOUNT)

> This is not a vserver specific issue, but rather a 
> linux one, one way to look at it is that mounting 
> a remote filesystem is not inherently a security 
> risk on the local system 

well, it can easily get to a DoS issue, when
e.g. the remote for an nfs mount goes aways, and
the kernel mostly locks up, for example

> (except perhaps for the suid problems), but rather
> a potential security issue on the remote system.  

> Limiting remote mounts should therefore be handled 
> by the remote machine, not the local one.

usually that is done via access mechanisms

> > I haven't tried using fstab.... Can glusterfs be
> > mounted from fstab at all? 
> 
> Yes, it works fine in the host's fstab.  

then it should be fine in the guest's fstab
too, modulo problems with fuse ...

> > I simply used an init script to run glusterfs 
> > when starting the guest..
> 
> How did you do this?  As I mentioned in a previous
> email for this thread, the following worked for 
> me:
> 
>  vnamespace -e <cid> mount.glusterfs <server> /<vserver_root>/<mntpnt>
> 
> I could automate that on startup, but I would prefer
> if the /etc/vserver/<guest>/fstab[.remote] worked,
> it surely makes management easier.  If the above
> works, why does the fstab not work?

no idea, how does it fail? any logs? details?

best,
Herbert

> Thanks,
> 
> -Martin
> 
> 
> 
> 
>