Subject: Re: [vserver] I'd like to --move it --move it
From: Herbert Poetzl <herbert@13thfloor.at>
Date: Tue, 14 Dec 2010 18:53:56 +0100

On Tue, Dec 14, 2010 at 05:41:59PM +0000, Ben Green wrote:
> Quoting "Herbert Poetzl" <herbert@13thfloor.at>:

> >I presume your mount syscall returns with
> >EINVAL not with EPERM (strace will show) and
> >that can be caused by a bunch of things

> >my bet would be that it is caused by the
> >shared namespace/mount propagation configure
> >by util-vserver to allow to administrate the
> >guest from outside ...

> >HTH,
> >Herbert

> Thanks muchly for the security info Herbert.

> You are correct, it returns EINVAL:
> readlink("/tmp/foo", 0x7fffc1482140, 4096) = -1 EINVAL (Invalid argument)

hmm, this is unrelated, look for a 'mount' returning EINVAL :)

> Is there a way to fix it?

well, you can talk to the mainline folks to 'allow'
move mounts in shared namespaces or you could simply
disable the check which blocks it (if that is the
actual reason), or you could disable the shared 
mount space in util-vserver startup ...

best,
Herbert

> Cheers,
> ==
> From Ben Green