Bug 1575198 - /tmp mount PROPAGATION=shared prevents oci-systemd-hook moving mounts from /tmp/ocitmp.XXXXXX to /var/lib/containers/..../merged/run
Summary: /tmp mount PROPAGATION=shared prevents oci-systemd-hook moving mounts from /t...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: oci-systemd-hook
Version: 28
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Daniel Walsh
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-05-05 04:21 UTC by aalba6675
Modified: 2018-08-04 21:45 UTC (History)
4 users (show)

Fixed In Version: oci-systemd-hook-0.1.17-3.gitbd86a79.fc28
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-08-04 21:45:41 UTC
Type: Bug


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github https://github.com/projectatomic libpod issues 730 0 None None None 2020-02-10 19:28:14 UTC
Github https://github.com/projectatomic oci-systemd-hook issues 92 0 None None None 2020-02-10 19:28:14 UTC

Description aalba6675 2018-05-05 04:21:38 UTC
Description of problem:
podman bind mounts from host filesystem  are failing

Version-Release number of selected component (if applicable):
podman-0.4.1-1.gitb51d327.fc28.x86_64
(also tested 0.5.1 from koji, 0.5.2 from master)
container-selinux-2.55-1.fc28.noarch

How reproducible:
Always


Steps to Reproduce:
1./usr/bin/podman run -v /volumes/test/home:/home:z --name=david_tin --entrypoint /sbin/init fedora:28
2.
3.

Actual results:
container create failed: container_linux.go:348: starting container process caused "process_linux.go:402: container init caused \"process_linux.go:385: running prestart hook 1 caused \\\"error running hook: exit status 1, stdout: , stderr: \\\"\""


Expected results:
container successfully running with bind mount

Additional info:
May 05 12:16:24 localhost.localdomain oci-systemd-hook[26363]: systemdhook <debug>: acb269681f2b: rootfs=/var/lib/containers/storage/overlay/2eb538c34dd0e18f0626870ba9f2b78113c6e16f6871512422c933ce7e16f49d/merged
May 05 12:16:24 localhost.localdomain oci-systemd-hook[26363]: systemdhook <debug>: acb269681f2b: gidMappings not found in config
May 05 12:16:24 localhost.localdomain oci-systemd-hook[26363]: systemdhook <debug>: acb269681f2b: GID: 0
May 05 12:16:24 localhost.localdomain oci-systemd-hook[26363]: systemdhook <debug>: acb269681f2b: uidMappings not found in config
May 05 12:16:24 localhost.localdomain oci-systemd-hook[26363]: systemdhook <debug>: acb269681f2b: UID: 0
May 05 12:16:24 localhost.localdomain oci-systemd-hook[26363]: systemdhook <error>: acb269681f2b: Failed to move mount /tmp/ocitmp.gGtQXQ to /var/lib/containers/storage/overlay/2eb538c34dd0e18f0626870ba9f2b78113c6e16f6871512422c933ce7e16f49d/merged/run: Invalid argument
May 05 12:16:24 localhost.localdomain oci-systemd-hook[26371]: systemdhook <error>: acb269681f2b: pid not found in state: Success
May 05 12:16:24 localhost.localdomain conmon[26338]: conmon <error>: Failed to create container: exit status 1
May 05 12:16:24 localhost.localdomain audit: NETFILTER_CFG table=filter family=2 entries=178
May 05 12:16:24 localhost.localdomain audit: NETFILTER_CFG table=nat family=2 entries=119
May 05 12:16:24 localhost.localdomain audit: NETFILTER_CFG table=nat family=2 entries=121

No avc errors

Comment 1 aalba6675 2018-05-05 04:31:22 UTC
oci-systemd-hook-0.1.15-1.git2d0b8a3.fc28.x86_64
oci-register-machine-0-6.1.git66fa845.fc28.x86_64
oci-umount-2.3.4-1.git87f9237.fc28.x86_64

Comment 2 aalba6675 2018-05-05 04:33:36 UTC
Same issue with oci-systemd-hook-1:0.1.16-1.git05bd9a0.fc28.x86_64 from koji

Comment 3 aalba6675 2018-05-05 04:34:05 UTC
oci-systemd-hook[8728]: systemdhook <error>: b512bbcd7aba: Failed to move mount /tmp/ocitmp.cR8CwC to /var/lib/containers/storage/overlay/6ab3df626ea9635786d8d5615d41f4c9124c349e42e37f558ecd7235d7bf8c3b/merged/run: Invalid argument

Comment 4 aalba6675 2018-05-05 08:37:11 UTC
Even just simulating the change (moving a tmpfs mount to .../merged/run gives the error

my_mount.c:
#include <stdio.h>
#include <error.h>
#include <sys/mount.h>

int main(int argc, char **argv) {
                if ((mount(argv[1], argv[2], "", MS_MOVE, "") == -1)) {
                        fprintf(stderr, "Failed to move mount %s to %s", argv[1], argv[2]);
                        perror("Error");
                        return -1;
                }
}


./my_mount  /tmp/ocitmp.D6swZ5 /var/lib/containers/storage/overlay/6ab3df626ea9635786d8d5615d41f4c9124c349e42e37f558ecd7235d7bf8c3b/merged/run
Failed to move mount /tmp/ocitmp.D6swZ5 to /var/lib/containers/storage/overlay/6ab3df626ea9635786d8d5615d41f4c9124c349e42e37f558ecd7235d7bf8c3b/merged/runError: Invalid argument

mount | grep oci
tmpfs on /tmp/ocitmp.D6swZ5 type tmpfs (rw,nosuid,nodev,relatime,context="system_u:object_r:container_file_t:s0:c500,c974",size=65536k,mode=755)
tmpfs on /tmp/ocitmp.D6swZ5/.containerenv type tmpfs (rw,nosuid,nodev,seclabel,mode=755)
tmpfs on /tmp/ocitmp.D6swZ5/secrets type tmpfs (rw,nosuid,nodev,seclabel,mode=755)

Comment 6 aalba6675 2018-05-05 08:47:44 UTC
Related to /tmp being mounted shared - but this is an all Fedora setup so I wonder whether this was taken into consideration when putting ocitmp.XXXXX into /tmp

# findmnt -o TARGET,PROPAGATION /tmp
TARGET PROPAGATION
/tmp   shared


# mount --make-private /tmp

./my_mount  /tmp/ocitmp.D6swZ5 /volumes/test/run
works!

Comment 7 aalba6675 2018-05-06 09:18:15 UTC
Setting /tmp to `private` is only a temporary fix. The container can start/stop twice then it runs into issues where cgroups do not seem to be properly clean up.

Upstream: https://github.com/projectatomic/libpod/issues/730

Comment 8 Fedora Update System 2018-07-26 11:50:56 UTC
oci-systemd-hook-0.1.17-3.gitbd86a79.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2018-cce6f4f53d

Comment 9 Fedora Update System 2018-07-26 16:33:49 UTC
oci-systemd-hook-0.1.17-3.gitbd86a79.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-cce6f4f53d

Comment 10 Fedora Update System 2018-08-04 21:45:41 UTC
oci-systemd-hook-0.1.17-3.gitbd86a79.fc28 has been pushed to the Fedora 28 stable repository. If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.