mirror of
git://git.proxmox.com/git/lxc.git
synced 2025-03-22 06:50:41 +03:00
0d5c2e056d
originally reported by Patrick William of Rack911Labs. note: this has a slight (but unavoidable) potential for breakage for containers that need a rw /sys for whatever reason. those should already have set "lxc.mount.auto" to contain "sys:rw" (or use a custom AA profile), because remounting /sys rw is only possible with trickery inside the container even without this patch.
NOTES:
Problems with RHEL7 kernel:
ret = unshare(CLONE_NEWUSER);
does not work, because:
---------------------------
# file: liinux-2.6-3.10.0/kernel/user_namespace.c
int create_user_ns(struct cred *new)
{
struct user_namespace *ns, *parent_ns = new->user_ns;
kuid_t owner = new->euid;
kgid_t group = new->egid;
int ret;
/* Currently disabled in RHEL7 */
return -EINVAL;
...
---------------------------
There is already an open bug:
https://bugzilla.redhat.com/show_bug.cgi?id=917708
Other links:
http://zurlinux.com/?p=2106