Subject: Re: [vserver] vnamespace mount -o remount,ro does not make it read-only
From:Sandino Araico Sánchez <sandino@sandino.net>
Date: Sat, 03 Dec 2011 00:28:30 -0600
Sat, 03 Dec 2011 00:28:30 -0600
You can use the fstab file in the vserver config

An example:  cat /etc/vservers/my-vserver/fstab
none    /proc           proc    defaults                0 0
none    /dev/pts        devpts  gid=5,mode=620          0 0
/shared/sites        /sites       none      bind,rw  0 0
/shared/vhosts.d /etc/apache2/vhosts.d none bind,ro 0 0

Or you can mount them manually before the vserver starts
mount -o bind,rw  /shared/sites /vservers/my-vserver/sites
mount -o bind,ro  /shared/vhosts.d 
/vservers/my-vserver/etc/apache2/vhosts.d


On 01/12/11 21:17, Christian Jaeger wrote:
> Hello,
>
> I want to bind mount a directory from the host (named 'tn') into a
> running vserver (named 't3'). I want the bind mount to be read-only.
> Yes I already know that mount --bind can't do them read-only
> immediately, so there will be a period during which the guest can
> write, but I can live with that right now. The real problem is that I
> can't manage to make the bind mount read-only at all.
>
> When I do the mounts from /etc/vservers/t3/fstab like with:
> /root/GIT /root/GIT none noatime,ro,bind 0 0
> they are correctly read-only. But when I try to do it manually, no go:
>
> First, to show that the commands work in the host context:
>
> tn:~# mount --bind ~chris/GIT/ /var/lib/vservers/t3/home/chris/GIT
> tn:~# touch /var/lib/vservers/t3/home/chris/GIT/fe
> tn:~# mount -o remount,ro /var/lib/vservers/t3/home/chris/GIT
> tn:~# touch /var/lib/vservers/t3/home/chris/GIT/fe
> touch: cannot touch `/var/lib/vservers/t3/home/chris/GIT/fe':
> Read-only file system
>
> i.e. as expected. Now,
>
> tn:~# vnamespace -e t3 mount --bind ~chris/GIT/
> /var/lib/vservers/t3/home/chris/GIT
> tn:~# vnamespace -e t3 mount -o remount,ro /var/lib/vservers/t3/home/chris/GIT
> tn:~# vnamespace -e t3 touch /var/lib/vservers/t3/home/chris/GIT/fe
> touch: cannot touch `/var/lib/vservers/t3/home/chris/GIT/fe':
> Read-only file system
>
> good, *but* this shows that the guest can still write there:
>
> chris@t3:~$ touch GIT/feh
> chris@t3:~$
>
> Why is this?
>
> Christian.


-- 
Sandino Araico Sánchez
http://sandino.net



You can use the fstab file in the vserver config

An example:  cat /etc/vservers/my-vserver/fstab
none    /proc           proc    defaults                0 0
none    /dev/pts        devpts  gid=5,mode=620          0 0
/shared/sites        /sites       none      bind,rw  0 0
/shared/vhosts.d /etc/apache2/vhosts.d none bind,ro 0 0

Or you can mount them manually before the vserver starts
mount -o bind,rw  /shared/sites /vservers/my-vserver/sites
mount -o bind,ro  /shared/vhosts.d /vservers/my-vserver/etc/apache2/vhosts.d


On 01/12/11 21:17, Christian Jaeger wrote:
Hello,

I want to bind mount a directory from the host (named 'tn') into a
running vserver (named 't3'). I want the bind mount to be read-only.
Yes I already know that mount --bind can't do them read-only
immediately, so there will be a period during which the guest can
write, but I can live with that right now. The real problem is that I
can't manage to make the bind mount read-only at all.

When I do the mounts from /etc/vservers/t3/fstab like with:
/root/GIT /root/GIT none noatime,ro,bind 0 0
they are correctly read-only. But when I try to do it manually, no go:

First, to show that the commands work in the host context:

tn:~# mount --bind ~chris/GIT/ /var/lib/vservers/t3/home/chris/GIT
tn:~# touch /var/lib/vservers/t3/home/chris/GIT/fe
tn:~# mount -o remount,ro /var/lib/vservers/t3/home/chris/GIT
tn:~# touch /var/lib/vservers/t3/home/chris/GIT/fe
touch: cannot touch `/var/lib/vservers/t3/home/chris/GIT/fe':
Read-only file system

i.e. as expected. Now,

tn:~# vnamespace -e t3 mount --bind ~chris/GIT/
/var/lib/vservers/t3/home/chris/GIT
tn:~# vnamespace -e t3 mount -o remount,ro /var/lib/vservers/t3/home/chris/GIT
tn:~# vnamespace -e t3 touch /var/lib/vservers/t3/home/chris/GIT/fe
touch: cannot touch `/var/lib/vservers/t3/home/chris/GIT/fe':
Read-only file system

good, *but* this shows that the guest can still write there:

chris@t3:~$ touch GIT/feh
chris@t3:~$

Why is this?

Christian.


-- 
Sandino Araico Sánchez 
http://sandino.net