<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>What do you mean "it only happens with libseccomp"? I have tried
to enable or disable <br>
</p>
<p>seccomp via CONFIG_SECCOMP, buf the results were same unless I
set MountFlags=shared.</p>
<p>Without propagation patch, all block device, such as '/dev/sda*',
mounted by systemd-udev, <br>
</p>
<p>are unaccessible to outside namespace, which means root user
cann't use '/dev/sda*'. Do you <br>
</p>
<p>have any suggestions for me?</p>
<p>Thanks.<br>
</p>
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 2018年02月22日 22:25, Burton, Ross
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAJTo0LaJ6EzLdBSs1K6n2u0O0DEtX8QJEEpdiQcv=vFh50_oyg@mail.gmail.com">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<div dir="ltr">We used to have this but it was removed in the 232
upgrade:
<div><br>
</div>
<div>
<div> * Drop mount propagation patch, it only happens with
libseccomp, OE doesnt</div>
<div> enable it</div>
</div>
<div><br>
</div>
<div>Is this not the case? Or are you enabling seccomp? Maybe
this should be a bbappend in meta-security?</div>
<div><br>
</div>
<div>Ross</div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On 22 February 2018 at 14:15,
Hongzhi.Song <span dir="ltr"><<a
href="mailto:hongzhi.song@windriver.com" target="_blank"
moz-do-not-send="true">hongzhi.song@windriver.com</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">MountFlags's
default value is shared in systemd-udevd.service. But
upstream<br>
sets MountFlags with slave just for keeping mounts done by
udev private to<br>
udevd, which causes block device mounted by udev unvisable
but being busy for<br>
host. So we revert it to shared to be propagated to host.<br>
<br>
Signed-off-by: Hongzhi.Song <<a
href="mailto:hongzhi.song@windriver.com"
moz-do-not-send="true">hongzhi.song@windriver.com</a>><br>
---<br>
...evd-re-enable-mount-<wbr>propagation-for-udevd.patch |
33 ++++++++++++++++++++++<br>
meta/recipes-core/systemd/<a href="http://systemd_234.bb"
rel="noreferrer" target="_blank" moz-do-not-send="true">syst<wbr>emd_234.bb</a>
| 1 +<br>
2 files changed, 34 insertions(+)<br>
create mode 100644 meta/recipes-core/systemd/<wbr>systemd/systemd-udevd-re-<wbr>enable-mount-propagation-for-<wbr>udevd.patch<br>
<br>
diff --git a/meta/recipes-core/systemd/<wbr>systemd/systemd-udevd-re-<wbr>enable-mount-propagation-for-<wbr>udevd.patch
b/meta/recipes-core/systemd/<wbr>systemd/systemd-udevd-re-<wbr>enable-mount-propagation-for-<wbr>udevd.patch<br>
new file mode 100644<br>
index 0000000000..fce7bdd796<br>
--- /dev/null<br>
+++ b/meta/recipes-core/systemd/<wbr>systemd/systemd-udevd-re-<wbr>enable-mount-propagation-for-<wbr>udevd.patch<br>
@@ -0,0 +1,33 @@<br>
+From 11a3312d36109f5e5a7697ddb05c53<wbr>3c51e2cd75 Mon Sep
17 00:00:00 2001<br>
+From: "Hongzhi.Song" <<a
href="mailto:hongzhi.song@windriver.com"
moz-do-not-send="true">hongzhi.song@windriver.com</a>><br>
+Date: Mon, 19 Feb 2018 20:43:02 -0500<br>
+Subject: [PATCH] systemd-udevd: re-enable mount propagation
for udevd<br>
+<br>
+Upstream-Status: Inappropriate [embedded specific]<br>
+<br>
+Change the mount propagation flag from MountFlags=slave to
MountFlags=shared<br>
+(default). Use shared to ensure that mounts and unmounts
are propagated from<br>
+systemd's namespace to the service's namespace and vice
versa, while use slave<br>
+to run processes so that none of their mounts and unmounts
will propagate to<br>
+the host.<br>
+<br>
+Signed-off-by: Hongzhi.Song <<a
href="mailto:hongzhi.song@windriver.com"
moz-do-not-send="true">hongzhi.song@windriver.com</a>><br>
+---<br>
+ units/<a href="http://systemd-udevd.service.in"
rel="noreferrer" target="_blank" moz-do-not-send="true">systemd-udevd.service.in</a>
| 1 -<br>
+ 1 file changed, 1 deletion(-)<br>
+<br>
+diff --git a/units/<a
href="http://systemd-udevd.service.in" rel="noreferrer"
target="_blank" moz-do-not-send="true">systemd-udevd.service.<wbr>in</a>
b/units/<a href="http://systemd-udevd.service.in"
rel="noreferrer" target="_blank" moz-do-not-send="true">systemd-udevd.service.<wbr>in</a><br>
+index fc037b5..841d7a8 100644<br>
+--- a/units/<a href="http://systemd-udevd.service.in"
rel="noreferrer" target="_blank" moz-do-not-send="true">systemd-udevd.service.<wbr>in</a><br>
++++ b/units/<a href="http://systemd-udevd.service.in"
rel="noreferrer" target="_blank" moz-do-not-send="true">systemd-udevd.service.<wbr>in</a><br>
+@@ -24,7 +24,6 @@ ExecStart=@rootlibexecdir@/<wbr>systemd-udevd<br>
+ KillMode=mixed<br>
+ WatchdogSec=3min<br>
+ TasksMax=infinity<br>
+-MountFlags=slave<br>
+ MemoryDenyWriteExecute=yes<br>
+ RestrictRealtime=yes<br>
+ RestrictAddressFamilies=AF_<wbr>UNIX AF_NETLINK AF_INET
AF_INET6<br>
+--<br>
+2.8.1<br>
+<br>
diff --git a/meta/recipes-core/systemd/<a
href="http://systemd_234.bb" rel="noreferrer"
target="_blank" moz-do-not-send="true">sy<wbr>stemd_234.bb</a>
b/meta/recipes-core/systemd/<a href="http://systemd_234.bb"
rel="noreferrer" target="_blank" moz-do-not-send="true">sy<wbr>stemd_234.bb</a><br>
index babc351cc8..42f4f1ec76 100644<br>
--- a/meta/recipes-core/systemd/<a
href="http://systemd_234.bb" rel="noreferrer"
target="_blank" moz-do-not-send="true">sy<wbr>stemd_234.bb</a><br>
+++ b/meta/recipes-core/systemd/<a
href="http://systemd_234.bb" rel="noreferrer"
target="_blank" moz-do-not-send="true">sy<wbr>stemd_234.bb</a><br>
@@ -32,6 +32,7 @@ SRC_URI += " \<br>
<a class="moz-txt-link-freetext" href="file://0001-main-skip-many">file://0001-main-skip-many</a>-<wbr>initialization-steps-when-<wbr>running-in-.patch
\<br>
<a class="moz-txt-link-freetext" href="file://CVE-2017-18078.patch">file://CVE-2017-18078.patch</a> \<br>
<a class="moz-txt-link-freetext" href="file://0001-resolved-fix-loop">file://0001-resolved-fix-loop</a>-<wbr>on-packets-with-pseudo-dns-<wbr>types.patch
\<br>
+ <a class="moz-txt-link-freetext" href="file://systemd-udevd-re">file://systemd-udevd-re</a>-<wbr>enable-mount-propagation-for-<wbr>udevd.patch
\<br>
"<br>
SRC_URI_append_qemuall = " <a class="moz-txt-link-freetext" href="file://0001-core-device.c">file://0001-core-device.c</a>-<wbr>Change-the-default-device-<wbr>timeout-to-2.patch"<br>
<span class="HOEnZb"><font color="#888888"><br>
--<br>
2.13.3<br>
<br>
--<br>
______________________________<wbr>_________________<br>
Openembedded-core mailing list<br>
<a
href="mailto:Openembedded-core@lists.openembedded.org"
moz-do-not-send="true">Openembedded-core@lists.<wbr>openembedded.org</a><br>
<a
href="http://lists.openembedded.org/mailman/listinfo/openembedded-core"
rel="noreferrer" target="_blank"
moz-do-not-send="true">http://lists.openembedded.org/<wbr>mailman/listinfo/openembedded-<wbr>core</a><br>
</font></span></blockquote>
</div>
<br>
</div>
</blockquote>
<br>
</body>
</html>