• Rob Landley's avatar
    Make CIFS mount work in a container. · f1d0c998
    Rob Landley authored
    Teach cifs about network namespaces, so mounting uses adresses/routing
    visible from the container rather than from init context.
    
    A container is a chroot on steroids that changes more than just the root
    filesystem the new processes see.  One thing containers can isolate is
    "network namespaces", meaning each container can have its own set of
    ethernet interfaces, each with its own own IP address and routing to the
    outside world.  And if you open a socket in _userspace_ from processes
    within such a container, this works fine.
    
    But sockets opened from within the kernel still use a single global
    networking context in a lot of places, meaning the new socket's address
    and routing are correct for PID 1 on the host, but are _not_ what
    userspace processes in the container get to use.
    
    So when you mount a network filesystem from within in a container, the
    mount code in the CIFS driver uses the host's networking context and not
    the container's networking context, so it gets the wrong address, uses
    the wrong routing, and may even try to go out an interface that the
    container can't even access...  Bad stuff.
    
    This patch copies the mount process's network context into the CIFS
    structure that stores the rest of the server information for that mount
    point, and changes the socket open code to use the saved network context
    instead of the global network context.  I.E. "when you attempt to use
    these addresses, do so relative to THIS set of network interfaces and
    routing rules, not the old global context from back before we supported
    containers".
    
    The big long HOWTO sets up a test environment on the assumption you've
    never used ocntainers before.  It basically says:
    
    1) configure and build a new kernel that has container support
    2) build a new root filesystem that includes the userspace container
    control package (LXC)
    3) package/run them under KVM (so you don't have to mess up your host
    system in order to play with containers).
    4) set up some containers under the KVM system
    5) set up contradictory routing in the KVM system and the container so
    that the host and the container see different things for the same address
    6) try to mount a CIFS share from both contexts so you can both force it
    to work and force it to fail.
    
    For a long drawn out test reproduction sequence, see:
    
      http://landley.livejournal.com/47024.html
      http://landley.livejournal.com/47205.html
      http://landley.livejournal.com/47476.htmlSigned-off-by: default avatarRob Landley <rlandley@parallels.com>
    Reviewed-by: default avatarJeff Layton <jlayton@redhat.com>
    Signed-off-by: default avatarSteve French <sfrench@us.ibm.com>
    f1d0c998
cifsglob.h 26.5 KB