{"action":"created","issue":{"url":"https://api.github.com/repos/systemd/systemd/issues/4145","repository_url":"https://api.github.com/repos/systemd/systemd","labels_url":"https://api.github.com/repos/systemd/systemd/issues/4145/labels{/name}","comments_url":"https://api.github.com/repos/systemd/systemd/issues/4145/comments","events_url":"https://api.github.com/repos/systemd/systemd/issues/4145/events","html_url":"https://github.com/systemd/systemd/pull/4145","id":177035603,"number":4145,"title":"core: introduce UseRootFileSystemNamespace option","user":{"login":"marcinpe","id":8174385,"avatar_url":"https://avatars.githubusercontent.com/u/8174385?v=3","gravatar_id":"","url":"https://api.github.com/users/marcinpe","html_url":"https://github.com/marcinpe","followers_url":"https://api.github.com/users/marcinpe/followers","following_url":"https://api.github.com/users/marcinpe/following{/other_user}","gists_url":"https://api.github.com/users/marcinpe/gists{/gist_id}","starred_url":"https://api.github.com/users/marcinpe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/marcinpe/subscriptions","organizations_url":"https://api.github.com/users/marcinpe/orgs","repos_url":"https://api.github.com/users/marcinpe/repos","events_url":"https://api.github.com/users/marcinpe/events{/privacy}","received_events_url":"https://api.github.com/users/marcinpe/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/systemd/systemd/labels/needs-discussion","name":"needs-discussion","color":"fbca04"},{"url":"https://api.github.com/repos/systemd/systemd/labels/pid1","name":"pid1","color":"c7def8"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2016-09-14T22:11:31Z","updated_at":"2016-10-11T14:56:04Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/systemd/systemd/pulls/4145","html_url":"https://github.com/systemd/systemd/pull/4145","diff_url":"https://github.com/systemd/systemd/pull/4145.diff","patch_url":"https://github.com/systemd/systemd/pull/4145.patch"},"body":"Allow user to specify that unit has to run in init's files system\r\nnamespace. Previously it was possible, iff none of the file system\r\nnamespace related option was set (but documentation gave no such\r\nwarranty). I wanted to have a formal and documented option which\r\nforces such behavior. This option is incompatible with: PrivateTmp=,\r\nPrivateDevices=, ProtectSystem=, ProtectHome=, ReadOnlyPaths=,\r\nInaccessiblePaths=, ReadWritePaths=, MountFlags=, meaning it\r\ncannot be set to true, if any of the listed options has non default\r\nvalue.\r\n\r\nWhy this is useful?\r\nWe like a lot setup in which ssh + few other of our daemons run\r\nin the root namespace. Thanks to that the mounts done by our\r\ndaemons are visible to users who ssh to a server to debug issues.\r\nThey are also visible to chef and our monitoring tools.\r\nOf course this can also be achieved by having the mounts marked as\r\nshared and not sharing the namespace. However, shared mounts\r\nhas proven problematic to us over time (especially how easy it is\r\nto create cycles).\r\nIn the current state of systemd we can make ssh + our daemons run\r\nin the root namespace, by making sure they do not use any of the\r\nfile system namespace related options. The dark side of this\r\napproach is, how easy it is to break it. We recently specified\r\nMountFlags=private and all worked nicely, until we realized\r\nssh cannot see the mounts done by our daemon (and our tools depend\r\non it). What is worse the documentation never promises that units\r\nwill run in root namespace, it just happens to be so.\r\nAs such we want to have an explicit option which forces unit\r\nto not clone file system namespace from systemd, but stay in\r\nthe original one."},"comment":{"url":"https://api.github.com/repos/systemd/systemd/issues/comments/252941915","html_url":"https://github.com/systemd/systemd/pull/4145#issuecomment-252941915","issue_url":"https://api.github.com/repos/systemd/systemd/issues/4145","id":252941915,"user":{"login":"poettering","id":2130732,"avatar_url":"https://avatars.githubusercontent.com/u/2130732?v=3","gravatar_id":"","url":"https://api.github.com/users/poettering","html_url":"https://github.com/poettering","followers_url":"https://api.github.com/users/poettering/followers","following_url":"https://api.github.com/users/poettering/following{/other_user}","gists_url":"https://api.github.com/users/poettering/gists{/gist_id}","starred_url":"https://api.github.com/users/poettering/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/poettering/subscriptions","organizations_url":"https://api.github.com/users/poettering/orgs","repos_url":"https://api.github.com/users/poettering/repos","events_url":"https://api.github.com/users/poettering/events{/privacy}","received_events_url":"https://api.github.com/users/poettering/received_events","type":"User","site_admin":false},"created_at":"2016-10-11T14:56:04Z","updated_at":"2016-10-11T14:56:04Z","body":"I am not convinced that adding such a \"negating\" option, that disables a good chunk of the others would be a good idea. I mean, let's note that none of the namespacing options defaults to on, which means, unless your unit file *explicitly* enabled any of these options your service will live in the host's main namespace. Hence, adding an option that allows you to *explicitly* turn off the effect of options you *explicitly turned on sounds less than ideal to me?\r\n\r\nMaybe this should really be dealt with as a documentation issue. For example, I am tempted to rearrange the systemd.exec man page, and place all security/sandboxing options that detach the mount namespace in a section of their own explaining the side-effect of using them in regards to detaching the services from mounts on the host. Would that be helpful?\r\n\r\nDoes that above make any sense?"}}
{"actor":{"display_login":"poettering"}}