Bug 882047

By the way, I'm not sure the reason but by "run-and-stop systemd" as below makes systemctl works again.
----
$ systemd
Failed to open private bus connection: Unable to autolaunch a dbus-daemon without a $DISPLAY for X11
(Stop it with Ctrl+C)
----

I looked into iproute2's source code.

I'm afraid that the "netns exec" part of "ip" is broken.

iproute2-3.6.0/ip/ipnetns.c.orig
============
    119 static int netns_exec(int argc, char **argv)
    120 {
...
    155         /* Mount a version of /sys that describes the network namespace */
    156         if (umount2("/sys", MNT_DETACH) < 0) {
    157                 fprintf(stderr, "umount of /sys failed: %s\n", strerror(errno));
    158                 return -1;
    159         }
    160         if (mount(name, "/sys", "sysfs", 0, NULL) < 0) {
    161                 fprintf(stderr, "mount of /sys failed: %s\n",strerror(errno));
    162                 return -1;
    163         }
    164 
    165         /* Setup bind mounts for config files in /etc */
    166         bind_etc(name);
    167 
    168         if (execvp(cmd, argv + 1)  < 0)
    169                 fprintf(stderr, "exec of %s failed: %s\n",
    170                         cmd, strerror(errno));
    171         exit(-1);
    172 }
============

1. This remounts "/sys" without any consideration and breaks the original mount tree under /sys.
2. This leaves the remounted /sys containing the child network namespace information.

The second point can be confirmed as below:
--------------
Add "parent" device in the parent namespace.
[root@localhost ~]# ls /sys/devices/virtual/net/
lo
[root@localhost ~]# ip link add parent type dummy
[root@localhost ~]# ls /sys/devices/virtual/net/
lo  parent

Add "child" device in the child (test) namespace.
[root@localhost ~]# ip netns add test
[root@localhost ~]# ip netns exec test ip link add child type dummy

In the parent namesapce, /sys remains as the child's one. You cannot see the "parent" device there.
[root@localhost ~]# ls /sys/devices/virtual/net/
child  lo
--------------

IMHO, it's better not to remount /sys from netns_exec, and let the executed command to take care of it. As "ip netns exec" is just a convenient way of tweaking the namespace, if you need more consistent namespace management, you'd better use the LXC container toolsets.

Removing the remount fixes the issue (obviously).

Given ip-netns(8) manpage, I'd say the current behaviour is intentional.  However, I agree with you this should be probably handled elsewhere as 'netns exec' users won't probably be interested in breaking their systemd mounts every time...

*** Bug 892927 has been marked as a duplicate of this bug. ***

I'm just checking if removing this bit might hit other things or not.

This was caused by mount changes in the new namespace propagated to the parent since /sys mounts were explicitly marked as shared.

A fix remounting the whole cloned tree as private should be upstream soon.

I'm blocked on other tasks due to this bug, is there anything I can help test to move progress along?

The patch got accepted upstream, I'll submit an update today.

iproute-3.6.0-6.fc18 has been submitted as an update for Fedora 18.
https://admin.fedoraproject.org/updates/iproute-3.6.0-6.fc18

iproute-3.6.0-6.fc18 worked for me. Thanks.

iproute-3.6.0-6.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.

This has worked for me too, thanks very much.

(In reply to comment #11)
> iproute-3.6.0-6.fc18 has been pushed to the Fedora 18 stable repository.  If
> problems still persist, please make note of it in this bug report.

Not sure why Bodhi hasn't changed status to CLOSED->ERRATA ?

iproute-3.3.0-6.fc17 has been submitted as an update for Fedora 17.
https://admin.fedoraproject.org/updates/iproute-3.3.0-6.fc17

iproute-3.3.0-6.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.