afonso/core-extra
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

SimpleLxcNode: Don't umount directories before killing vnoded

Browse source 
A node's private mounts are currently removed before killing
vnoded, which makes them unavailable during container service
shutdown. Any such service accessing the filesystem for atexit()
cleanup (e.g., rsyslogd), will do so on the host filesystem
instead, very likely causing unintended damage.

For example, the default behavior of rsyslogd is to remove its
listening socket (/dev/log, or /run/systemd/journal/dev-log) at
shutdown from its atexit() handler. If the node's private '/dev'
or '/run/systemd/journal' mount has already been removed, the
host-side /dev/log or /run/systemd/journal/dev-log sockets will
be removed instead!

Since non-persistent (mount) namespaces are automatically
destroyed by the kernel when the last process referencing them
is killed, we should simply rely on that behavior instead of
explicitly (and prematurely) unmounting a node's private
directories during shutdown.

Signed-off-by: Gabriel Somlo <glsomlo@cert.org>
This commit is contained in:
Gabriel Somlo 2017-10-09 16:18:46 -04:00
parent 06d4c4661d
commit a5ae485fa6
1 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
daemon/core/netns/vnode.py
View file

@ -120,7 +120,8 @@ class SimpleLxcNode(PyCoreNode):
# unmount all targets # unmount all targets
while self._mounts: while self._mounts:
source, target = self._mounts.pop(-1) source, target = self._mounts.pop(-1)
self.umount(target) # Mount namespaces automatically removed when last process exits!
#self.umount(target)
# shutdown all interfaces # shutdown all interfaces
for netif in self.netifs(): for netif in self.netifs():