Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Description of problem:
iproute should have this patch: https://patchwork.ozlabs.org/patch/796300/
Version-Release number of selected component (if applicable):
RHEL 7
iproute 4.11.0-14.el7
OSP13z9 (related to https://bugzilla.redhat.com/show_bug.cgi?id=1758547)
How reproducible:
Always
Steps to Reproduce:
In a rebooted system, without any namespace and /run/netns not created yet:
1. Create a namespace with a non-patched version of iproute2
$ ip netns add temp_namespace
2. Rebind and share the directory /run/netns. This is what a patched version of iproute2 should do in first place:
$ mount --rbind /run/netns /run/netns
$ mount --make-shared /run/netns
3. Create another namespace
$ ip netns add temp_namespace_2
Actual results:
The first namespace (and any other one) created before the rebind, will become unusable.
Expected results:
/run/netns should be mounted as shared:
$ findmnt -o+PROPAGATION
...
├─/run/netns tmpfs[/netns] tmpfs rw,nosuid,noexec,relatime,size=2468224k,mode=755 shared
Additional info:
Trivial upstream commit to backport:
commit d6a4076b6ba6547d7e52c377a7c58c56eb5ea16e
Author: Casey Callendrello <casey.callendrello>
Date: Tue Aug 1 17:46:09 2017 +0200
netns: make /var/run/netns bind-mount recursive
When ip netns {add|delete} is first run, it bind-mounts /var/run/netns
on top of itself, then marks it as shared. However, if there are already
bind-mounts in the directory from other tools, these would not be
propagated. Fix this by recursively bind-mounting.
Signed-off-by: Casey Callendrello <casey.callendrello>
Acked-by: "Eric W. Biederman" <ebiederm>
To reproduce the problem described in backported commit's message:
1. Setup the trap:
# ip netns add test
# mount --make-private /run/netns
# umount /run/netns/test
# umount /run/netns
At this point, netns should work as usual, i.e. /run/netns/test is mounted, has
normal permissions and commands like 'ip -net test link show' work as expected.
2. Let it snap:
# ip netns add test2
At this point, /run/netns/test has all-zero permissions and netns is not usable
anymore.
With above patch applied, the command in (2) should not affect netns 'test'.