From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Thompson, David" Subject: Re: [PATCH] environment: container: Do not remount network files as read-only. Date: Sat, 26 Mar 2016 10:06:58 -0400 Message-ID: References: <87wpozldb5.fsf@gnu.org> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:35466) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ajorl-0003XA-Dt for guix-devel@gnu.org; Sat, 26 Mar 2016 10:07:02 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ajork-00036k-FB for guix-devel@gnu.org; Sat, 26 Mar 2016 10:07:01 -0400 Received: from mail-qk0-x233.google.com ([2607:f8b0:400d:c09::233]:34366) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ajorj-00036U-8L for guix-devel@gnu.org; Sat, 26 Mar 2016 10:07:00 -0400 Received: by mail-qk0-x233.google.com with SMTP id x64so18146958qkd.1 for ; Sat, 26 Mar 2016 07:06:59 -0700 (PDT) In-Reply-To: <87wpozldb5.fsf@gnu.org> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org To: =?UTF-8?Q?Ludovic_Court=C3=A8s?= Cc: guix-devel On Fri, Mar 18, 2016 at 4:51 PM, Ludovic Court=C3=A8s wrote: > "Thompson, David" skribis: > >> I noticed that 'guix environment --container --network' didn't work on >> an Ubuntu machine I was on, and the culprit was remounting things like >> /etc/resolv.conf read-only after the initial bind mount. > > [...] > >> (file-system-mapping >> (source file) >> (target file) >> - (writable? #f)))) >> + ;; An unpriviliged user mi= ght not >> + ;; be able to remount >> + ;; /etc/resolv.conf as rea= d-only, >> + ;; so we say that it is wr= itable >> + ;; here, even though in pr= actice >> + ;; it is not. >> + (writable? #t)))) >> %network-configuration-files) > > Not sure I understand: why would bind-mounting /etc/resolv.conf > read-only fail? I haven't figured out the exact reason yet, but here's a strace snippet as proof: [pid 11334] mount("/etc/resolv.conf", "/tmp/guix-directory.Rc4nc6//etc/resolv.conf", 0x23da000, MS_RDONLY|MS_BIND, NULL) =3D 0 [pid 11334] mount("/etc/resolv.conf", "/tmp/guix-directory.Rc4nc6//etc/resolv.conf", 0x23e4080, MS_RDONLY|MS_REMOUNT|MS_BIND, NULL) =3D -1 EPERM (Operation not permitted) Another Ubuntu user was able to reproduce this as well. I find it kind of silly to mount these files read-only because an unprivileged user couldn't write to them anyway. WDYT? - Dave