From: Lucas Nussbaum <lucas.nussbaum@inria.fr>
To: 46292@debbugs.gnu.org
Subject: bug#46292: more info
Date: Wed, 10 Feb 2021 07:04:03 +0100 [thread overview]
Message-ID: <20210210060403.GA15175@xanadu.blop.info> (raw)
In-Reply-To: <87h7ms8658.fsf@inria.fr>
Hi,
This is not due to NFS, but due to the fact that the NFS mount is
mounted nosuid (and nodev, probably). I can reproduce it on a local
filesystem mounted nosuid.
It seems that, when remounting a bind mount which is originally nosuid
inside a mount ns, you need to specify explicitely the nosuid option, or
else can_change_locked_flags()[1] will return false.
[1] https://github.com/torvalds/linux/blame/master/fs/namespace.c#L2480
There's a concept of "locked mount flags" that cannot be cleared by a
less privileged user (see [2]). Our call to 'mount -o remount' ignores the
fact that the filesystem is mounted nosuid (and does not include this
flag), so the remount call tries to remove nosuid, and fails.
[2] https://github.com/torvalds/linux/commit/9566d6742852c527bf5af38af5cbb878dad75705
This probably needs to be fixed in Guix by fetching the current mount
flags and including them in the bind+remount+readonly call.
Unfortunately I did not find an easy way to convert mount flags in
/proc/$$/mountinfo to flags for the mount syscall...
Lucas
next prev parent reply other threads:[~2021-02-10 9:28 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-02-04 10:43 bug#46292: ‘guix environment -C’ fails with Linux 4.19 (Debian) Ludovic Courtès
2021-02-04 12:38 ` zimoun
2021-02-04 14:41 ` Ludovic Courtès
2021-02-10 6:04 ` Lucas Nussbaum [this message]
2021-02-18 11:38 ` Ludovic Courtès
2021-02-18 13:23 ` Lucas Nussbaum
2021-02-22 9:46 ` Ludovic Courtès
2021-02-22 10:57 ` Lucas Nussbaum
2021-02-22 13:59 ` Ludovic Courtès
2021-02-22 16:44 ` bug#46292: [PATCH 1/3] syscalls: Define MS_RELATIME Ludovic Courtès
2021-02-22 16:44 ` bug#46292: [PATCH 2/3] syscalls: Add 'mounts' and the <mount> record type Ludovic Courtès
2021-02-22 16:44 ` bug#46292: [PATCH 3/3] file-systems: 'mount-file-system' preserves source flags for bind mounts Ludovic Courtès
2021-02-25 10:43 ` bug#46292: ‘guix environment -C’ fails with Linux 4.19 (Debian) Ludovic Courtès
2021-02-18 11:36 ` Ludovic Courtès
2021-03-09 16:19 ` bug#46292: Reopen Andreas Enge
2021-03-09 20:55 ` Andreas Enge
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://guix.gnu.org/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210210060403.GA15175@xanadu.blop.info \
--to=lucas.nussbaum@inria.fr \
--cc=46292@debbugs.gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/guix.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).