Subject: Re: [vserver] Bind Mount into VServer fails due to permission problems
From: Herbert Poetzl <herbert@13thfloor.at>
Date: Thu, 5 Nov 2009 14:56:35 +0100

On Thu, Nov 05, 2009 at 01:45:45PM +0100, Thomas Gebhardt wrote:
> Hi,

> I have a NFS mounted partition on the host system that I want to
> propagate to the VServer(s) on that host by a bind mount in
> /etc/vservers/<vname>/fstab :
> /fs/home (on the host) ->  /home (Vserver)

> This works perfectly well with debian sarge (util-vserver 0.30.214-6)
> but fails in debian lenny (util-vserver 0.30.216~r2772) due to a
> permission problem:

> ++ /usr/lib/util-vserver/secure-mount -a --chroot --fstab
> /etc/vservers/<vname>/fstab --rootfs no
> secure-mount: chdir("/home"): Permission denied
> /etc/vservers/<vname>/fstab:4:1: failed to mount fstab-entry

> Indeed root cannot chdir to /fs/home, since it is NFS-exported
> with the root_squash option (and non-priviledged users aren't
> allowed to chdir to /home).

IMHO the chdir happens _before_ the --bind mount should
be affective, maybe you mounted it already there or
you have a problem with the barrier flag (note that
the debian 2.6.26 branch is broken and requires manual
fixes to all the attribute flags when switching to or
from such a kernel), besides that, I'd suggest to get
a more recent util-vserver snapshot ...

> How can I get around this problem without changing the permissions
> on the NFS server?

things which might work:

 - you can do the bind mount before the the guest is
   started (either permanently or via one of the
   guest start scripts) and exclude the path from the
   namespace cleanup

 - you could put the actual nfs mount in the guest's
   fstab.remote, as long as mounting itself can happen

HTH,
Herbert

> Thanks for any hint! Th. Gebhardt