Bug 1209594

man unshare:

Mounting and unmounting filesystems will not affect the rest  of  the  system  (CLONE_NEWNS flag),  except  for  filesystems  which are explicitly marked as shared (with mount --make-shared; see /proc/self/mountinfo for the shared flags).

It's recommended to use mount --make-rprivate or mount --make-rslave after unshare  --mount to make sure that mountpoints in the new namespace are really unshared from parental names‐pace.


... on RHEL-7 (due to systemd) the default is "shared" flag. The current unshare(1) behaviour is normal.

In upstream tree we have a patch (f0f22e9c6f109f8c1234caa3173368ef43b023eb) to explicitly mark the mount tree in a new namespace as "private" to hide the difference between distributions. Maybe we can backport this to RHEL7.

Hello Karel,

Thank you for your message. However, I'm not seeing the behavior work as described in your comment. When I run mount --make-rprivate /mnt/sda1 (for example) after the unshare -m I do see the shared flag disappear from /proc/self/mountinfo. However, when I do the unmount in the unshare -m environment, I still see the entire filesystem unmount for all environments. 

Shell 1:

# mount /dev/sda1 /mnt/sda1/
# mount --make-rprivate /mnt/sda1/
# grep sda1 /proc/self/mountinfo 
44 37 8:1 / /mnt/sda1 rw,relatime - ext4 /dev/sda1 rw,seclabel,data=ordered

 - so no shared flag in the entry

Shell 2:

# unshare -m
# grep sda1 /proc/self/mountinfo 
73 46 8:1 / /mnt/sda1 rw,relatime - ext4 /dev/sda1 rw,seclabel,data=ordered
# umount /mnt/sda1
# grep sda1 /proc/mounts
#

Back to Shell 1:

# grep sda1 /proc/mounts
#

Please let me know if this is expected? Perhaps I'm doing something wrong, but I'm still not seeing the namespaces be separated.

Thanks!

Well, I thought something else:

# mount /dev/sdc1 /mnt/test

# unshare --mount
# mount --make-rprivate /
# umount /mnt/test

Now within unshared shell it's umounted, but rest of the system see the device still mounted.

Note that --make-rprivate is executed within the namespace!

The current upstream unshare(1) version calls --make-rprivate automatically, so it's possible to skip this extra step.

---

Just for the record -- if you want to rewrite your example and call --make-rprivate outside the namespace than you have to do:

Shell 1:

# mount --bind /mnt/test /mnt/test
# mount --make-rprivate /mnt/test
# mount /dev/sdc1 /mnt/test

Shell 2:
# unshare --mount
# umount /mnt/test
# findmnt /dev/sdc1; echo $?
1

... not mounted within the namespace

back to Shell 1:
# findmnt /dev/sdc1
TARGET    SOURCE    FSTYPE OPTIONS
/mnt/test /dev/sdc1 ext4   rw,relatime,seclabel,stripe=32,data=ordered

... still mounted :-)

In this case you create "private" subtree /mnt/test and mount the device into the tree (the propagation is controlled by parent, not by the filesystem). Anyway I guess this is too complicated and mostly academical, IMHO my previous example is more usable.

(In reply to Karel Zak from comment #4)

Thanks Karel,

With your example 1 above the unshared mounts namespace works as I expected. I appreciate the clarity.

Thanks,
Wesley

> Well, I thought something else:
> 
> # mount /dev/sdc1 /mnt/test
> 
> # unshare --mount
> # mount --make-rprivate /
> # umount /mnt/test
> 
> Now within unshared shell it's umounted, but rest of the system see the
> device still mounted.
> 
> Note that --make-rprivate is executed within the namespace!
> 
> The current upstream unshare(1) version calls --make-rprivate automatically,
> so it's possible to skip this extra step.
> 
> ---
> 
> Just for the record -- if you want to rewrite your example and call
> --make-rprivate outside the namespace than you have to do:
> 
> Shell 1:
> 
> # mount --bind /mnt/test /mnt/test
> # mount --make-rprivate /mnt/test
> # mount /dev/sdc1 /mnt/test
> 
> Shell 2:
> # unshare --mount
> # umount /mnt/test
> # findmnt /dev/sdc1; echo $?
> 1
> 
> ... not mounted within the namespace
> 
> back to Shell 1:
> # findmnt /dev/sdc1
> TARGET    SOURCE    FSTYPE OPTIONS
> /mnt/test /dev/sdc1 ext4   rw,relatime,seclabel,stripe=32,data=ordered
> 
> ... still mounted :-)
> 
> In this case you create "private" subtree /mnt/test and mount the device
> into the tree (the propagation is controlled by parent, not by the
> filesystem). Anyway I guess this is too complicated and mostly academical,
> IMHO my previous example is more usable.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-2093.html