Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

PivotRoot调用失败,Invalid arguments error #3

Open
taikulawo opened this issue Sep 7, 2019 · 0 comments
Open

PivotRoot调用失败,Invalid arguments error #3

taikulawo opened this issue Sep 7, 2019 · 0 comments

Comments

@taikulawo
Copy link
Owner

问题

问题的存档放在如下的 commit

https://github.com/iamwwc/wwcdocker/tree/5490793ea136bdffabb297b169197ea41fd6b4ec

根据 mount namespace 的文档

http://man7.org/linux/man-pages/man7/mount_namespaces.7.html#top_of_page

 Notwithstanding the fact that the default propagation type for new
       mount points is in many cases MS_PRIVATE, MS_SHARED is typically more
       useful.  For this reason, systemd(1) automatically remounts all mount
       points as MS_SHARED on system startup.  Thus, on most modern systems,
       the default propagation type is in practice MS_SHARED.

systemd会将 fs 修改为 shared,但从 pivot_root文档中Errors session可知:

http://man7.org/linux/man-pages/man2/pivot_root.2.html

  EINVAL new_root is not a mount point.

       EINVAL put_old is not underneath new_root.

       EINVAL The current root is on the rootfs (initial ramfs) filesystem.

       EINVAL Either the mount point at new_root, or the parent mount of
              that mount point, has propagation type MS_SHARED.

       EINVAL put_old is a mount point and has the propagation type
              MS_SHARED.

pivot root 不允许 parent mount point 和 new mount point 是 shared。

那我们应该如何修复这个问题?

  1. 可以修改为 MS_PRIVATE(mount --make-rprivate /)
  2. 根据 docker runC 注释

https://github.com/opencontainers/runc/blob/a6606a7ae9d9e00bf0a8721ee1d4eb095fcc4ad6/libcontainer/rootfs_linux.go#L655

https://github.com/opencontainers/runc/blob/a6606a7ae9d9e00bf0a8721ee1d4eb095fcc4ad6/libcontainer/rootfs_linux.go#L739

也可以使用 MS_SLAVE

taikulawo added a commit that referenced this issue Sep 7, 2019
.
这是一个Rebase合并

全部的合并分别进行了测试,最后修复了

#3

但 wwcdocker run -ti busybox sh 运行之后并不会获得 sh

进程直接会结束,需要在后续的commit中修复
taikulawo added a commit that referenced this issue Sep 7, 2019
* 来自
xianlubird/mydocker#41 (comment)

```
// systemd 加入linux之后, mount namespace 就变成 shared by default, 所以你必须显示
	//声明你要这个新的mount namespace独立。
	syscall.Mount("", "/", "", syscall.MS_PRIVATE | syscall.MS_REC, "")

	defualtMountFlags := syscall.MS_NOEXEC | syscall.MS_NOSUID | syscall.MS_NODEV
	syscall.Mount("proc", "/proc", "proc", uintptr(defualtMountFlags), "")
```

开个分支测试,如果失败,那么虚拟机回滚


这是一个Rebase合并

全部的合并分别进行了测试,最后修复了

#3

但 wwcdocker run -ti busybox sh 运行之后并不会获得 sh

进程直接会结束,需要在后续的commit中修复
taikulawo added a commit that referenced this issue Sep 7, 2019
* 来自
`https://github.com/xianlubird/mydocker/issues/41#issuecomment-478799767`

```
// systemd 加入linux之后, mount namespace 就变成 shared by default, 所以你必须显示
	//声明你要这个新的mount namespace独立。
	syscall.Mount("", "/", "", syscall.MS_PRIVATE | syscall.MS_REC, "")

	defualtMountFlags := syscall.MS_NOEXEC | syscall.MS_NOSUID | syscall.MS_NODEV
	syscall.Mount("proc", "/proc", "proc", uintptr(defualtMountFlags), "")
```

开个分支测试,如果失败,那么虚拟机回滚

这是一个Rebase合并

全部的合并分别进行了测试,最后修复了

#3

但 wwcdocker run -ti busybox sh 运行之后并不会获得 sh

进程直接会结束,需要在后续的commit中修复
taikulawo added a commit that referenced this issue Sep 7, 2019
http://man7.org/linux/man-pages/man2/execve.2.html

```
 int execve(const char *pathname, char *const argv[],
                  char *const envp[]);
```

argv[0] 应该为 如上的pathname

同时,这个 commit 也完整修复了 PivotRoot调用失败的问题

#3
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant