Kommentare zu: Running a script with unshared mount namespace

Von: Martin Pitt: Running a script with unshared mount namespace - Bartle Doo

Martin Pitt: Running a script with unshared mount namespace - Bartle Doo — Mon, 17 Dec 2012 04:18:17 +0000

[...] Planet Ubuntu GD Star [...]

Von: Anonymous

Anonymous — Sun, 16 Dec 2012 20:43:05 +0000

@Jeff, Colin: Note that either the environment variable or argument approach requires you to trust the caller. Given that, what makes an environment variable preferred?

Von: Colin Watson

Colin Watson — Sun, 16 Dec 2012 10:53:59 +0000

I agree with Jeff (#5): use an environment variable and self-re-exec. See os-prober for an example of this.

Von: Jeff Epler

Jeff Epler — Sun, 16 Dec 2012 03:15:53 +0000

#3 has the right idea, but it would be even better if you could use some kind of environmental test instead of an explicit commandline item. second best would be to communicate via the environment instead: exec env UNSHARED=yes unshare -m “$0″ “$@”.

You can also pull this logic out to a script that is read via “.”, so instead of a repeated stanza it’s just
. run-unshared-please
if a qualified path if required.

Von: Anonymous

Anonymous — Sun, 16 Dec 2012 00:37:27 +0000

Assuming you trust the calling process, this seems slightly less ugly than tail and sh -c:

#!/bin/sh
if [ "$1" != "_unshared_" ]; then
exec unshare -m “$0″ _unshared_ “$@”
else
shift
fi
# rest of script

Von: dp

dp — Sat, 15 Dec 2012 22:46:36 +0000

You can avoid the hard coding of the starting lines number using
an hard coded comment, try replacing:
tail -n +7
with
sed -ne ‘/^# unshared program start/,$p’
or for more flexibility
awk ‘/^# unshared program start/,/# unshared program end/’

Von: pitti

pitti — Sat, 15 Dec 2012 21:08:14 +0000

Thanks, nice trick! The whole test suite of postgresql-common is perl, so it wouldn’t matter at all for this. I just wish there would be a similar way with using /bin/sh.

Von: Michael

Michael — Sat, 15 Dec 2012 20:35:10 +0000

Would the following work?
#!/usr/bin/perl -eexec ‘unshare’, ‘-uim’, ‘sh’, @ARGV