Why Can’t Bind-Mount / Inside a User Namespace? – Explained

bind-mountmountnamespaceuserns

Why doesn't this work?

$ unshare -rm mount --bind / /mnt
mount: /mnt: wrong fs type, bad option, bad superblock on /, missing codepage or helper program, or other error.

These work ok:

$ unshare -rm mount --bind /tmp /mnt
$ unshare -rm mount --bind /root /mnt
$

$ uname -r  # Linux kernel version
4.17.3-200.fc28.x86_64

Best Answer

The difference is that / has child mounts. Inside a user namespace, you are not allowed to separate inherited mounts from their child mounts. A more obvious example is that you are not allowed to umount /proc. Otherwise, it could suddenly grant you access to files that were hidden underneath other mounts. Overmounts are sometimes used deliberately as a security measure.

You are allowed to create a recursive bind mount instead, which preserves all the sub-mounts:

$ unshare -rm mount --rbind / /mnt

Related Solutions

Gentoo – How to Mount USB (FAT) in Gentoo

You need to set codepage and charset in kernel options:

make menuconfig -> File systems:
-> Native language support:
<*>   Codepage 437 (United States, Canada)
<*>   NLS ISO 8859-1  (Latin 1; Western European Languages)

-> DOS/FAT/NT Filesystems
(437) Default codepage for FAT
(iso8859-1) Default iocharset for FAT

and then recompile kernel...

Linux – Why can I not bind a mount namespace to a file

Given that it only affects the mount namespace, I am extremely suspicious that this is due to one of the loop prevention checks for mount namespaces. I do not think it is the exact same case as the link talks about, because unshare --mount defaults to setting mount propagation to private, i.e. disabling it.

However, to protect against certain race conditions, I think full correctness might require that you mount your mount namespaces inside a mount which has private mount propagation. I also think it might be cleanest (easiest to debug) if you use unbindable. (I think unbindable already includes all the effects of private).

I.e. mount your mount namespaces inside a directory prepared using:

mount --bind /var/local/lib/myns/ /var/local/lib/myns/
mount --make-unbindable /var/local/lib/myns/

In general I think this is the safest approach, to avoid ever triggering such a problem.

My race condition is hypothetical. I would not expect you to be hitting it most of the time. So I do not know what your actual problem is.

Best Answer

Related Solutions

Gentoo – How to Mount USB (FAT) in Gentoo

Linux – Why can I not bind a mount namespace to a file

Related Question