Bind mount device nodes on EPERM

[ashahab-altiscale]

Enables launching userns containers by catching EPERM errors for writing
to devices cgroups, and for mknod invocations.

This reflected the changes suggested by @mrunalp and @crosbymichael in opencontainers/runtime-spec#228

Signed-off-by: Abin Shahab ashahab@altiscale.com

[hqhq]

I don't think this is what they suggested, this will omit those real EPERM errors. Maybe we need some hack like #351 did, which needs to be more robust that people can not fool.

@crosbymichael @mrunalp what's your suggestion indeed? Maybe I understand wrong?

[ashahab-altiscale]

@hqhq The only other alternative that I see to this approach is that runC stop manipulating cgroups completely, and the operator pass the entire cgroup to runC. That's a larger change, and requires more design discussion than this one.

[crosbymichael]

the bind mount is what I had in mind but i'm not sure what to do with the cgroup errors yet.

[ashahab-altiscale]

@mrunalp Did you ask Eric Beiderman what he thinks of catching EPERMs when host is unprivileged?

[mrunalp]

He said that we shouldn't have to check and kernel should be fixed whereever we need to check.
However, in this scenario, it looks like we could workaround by making the cgroup writeable by top level container (under which the other containers are nested)?

[ashahab-altiscale]

No, that does not work. I did make the cgroup writeable, and I'm able to
write to all other groups other than devices.

On Tue, Nov 3, 2015 at 2:26 PM, Mrunal Patel notifications@github.com
wrote:

He said that we shouldn't have to check and kernel should be fixed
whereever we need to check.
However, in this scenario, it looks like we could workaround by making the
cgroup writeable by top level container (under which the other containers
are nested)?

—
Reply to this email directly or view it on GitHub
#357 (comment).

[ashahab-altiscale]

@mrunalp any other suggestions on how to get this done for now?

[ashahab-altiscale]

@mrunalp @crosbymichael Another way to get this done maybe is:

1. Catch EPERM for mknod error as this PR(that seems less controvertial)
2. For Cgroups, don't catch any EPERM, but allow a way for the operator to pass a fully specified cgroupsPath(@mrunalp indicated this feature exists but I don't think so), and do not write to the devices of this passed in cgroup. What do you guys think?

[crosbymichael]

eperm on mknod sounds good to me for this first step

[ashahab-altiscale]

@crosbymichael Ok, I will remove the cgroup stuff from here and wait for @hqhq to merge his or my PR regarding cgroupsPath.

[ashahab-altiscale]

@crosbymichael @mrunalp Removed cgroups changes. Now Im only checking EPERM for mknod.

[crosbymichael]

LGTM

[LK4D4]

LGTM