{"action":"created","issue":{"url":"https://api.github.com/repos/docker/docker/issues/15973","repository_url":"https://api.github.com/repos/docker/docker","labels_url":"https://api.github.com/repos/docker/docker/issues/15973/labels{/name}","comments_url":"https://api.github.com/repos/docker/docker/issues/15973/comments","events_url":"https://api.github.com/repos/docker/docker/issues/15973/events","html_url":"https://github.com/docker/docker/issues/15973","id":104234953,"number":15973,"title":"`/sys` should be mounted readonly also in privileged containers","user":{"login":"paulmenzel","id":9318792,"avatar_url":"https://avatars.githubusercontent.com/u/9318792?v=3","gravatar_id":"","url":"https://api.github.com/users/paulmenzel","html_url":"https://github.com/paulmenzel","followers_url":"https://api.github.com/users/paulmenzel/followers","following_url":"https://api.github.com/users/paulmenzel/following{/other_user}","gists_url":"https://api.github.com/users/paulmenzel/gists{/gist_id}","starred_url":"https://api.github.com/users/paulmenzel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/paulmenzel/subscriptions","organizations_url":"https://api.github.com/users/paulmenzel/orgs","repos_url":"https://api.github.com/users/paulmenzel/repos","events_url":"https://api.github.com/users/paulmenzel/events{/privacy}","received_events_url":"https://api.github.com/users/paulmenzel/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":19,"created_at":"2015-09-01T10:20:13Z","updated_at":"2016-06-05T17:33:57Z","closed_at":"2016-06-05T17:33:57Z","body":"When using Docker 1.6.2 and a Debian 8.1 (Jessie) image, when running a Docker container (with the capability `SYS_ADMIN` added) from it with systemd 215-17+deb8u1, `/sys` is mounted initially with read-write permissions and is only later on switched to read-only by systemd (probably by systemd-remount-fs).\r\n\r\n```\r\n# grep sys /proc/self/mounts         \r\nsysfs /sys sysfs rw,nosuid,nodev,noexec,relatime 0 0\r\nsecurityfs /sys/kernel/security securityfs rw,nosuid,nodev,noexec,relatime 0 0\r\ntmpfs /sys/fs/cgroup tmpfs ro,nosuid,nodev,noexec,mode=755 0 0\r\ncgroup /sys/fs/cgroup/systemd cgroup rw,nosuid,nodev,noexec,relatime,xattr,release_agent=/lib/systemd/systemd-cgroups-agent,name=systemd 0 0\r\npstore /sys/fs/pstore pstore rw,nosuid,nodev,noexec,relatime 0 0\r\ncgroup /sys/fs/cgroup/cpuset cgroup rw,nosuid,nodev,noexec,relatime,cpuset 0 0\r\ncgroup /sys/fs/cgroup/cpu,cpuacct cgroup rw,nosuid,nodev,noexec,relatime,cpu,cpuacct 0 0\r\ncgroup /sys/fs/cgroup/devices cgroup rw,nosuid,nodev,noexec,relatime,devices 0 0\r\ncgroup /sys/fs/cgroup/freezer cgroup rw,nosuid,nodev,noexec,relatime,freezer 0 0\r\ncgroup /sys/fs/cgroup/net_cls,net_prio cgroup rw,nosuid,nodev,noexec,relatime,net_cls,net_prio 0 0\r\ncgroup /sys/fs/cgroup/blkio cgroup rw,nosuid,nodev,noexec,relatime,blkio 0 0\r\ncgroup /sys/fs/cgroup/perf_event cgroup rw,nosuid,nodev,noexec,relatime,perf_event 0 0\r\nsystemd-1 /proc/sys/fs/binfmt_misc autofs rw,relatime,fd=22,pgrp=1,timeout=300,minproto=5,maxproto=5,direct 0 0\r\ndebugfs /sys/kernel/debug debugfs rw,relatime 0 0\r\nfusectl /sys/fs/fuse/connections fusectl rw,relatime 0 0\r\n# more /etc/fstab\r\n# UNCONFIGURED FSTAB FOR BASE SYSTEM\r\n# systemctl status systemd-remount-fs\r\n● systemd-remount-fs.service - Remount Root and Kernel File Systems\r\n   Loaded: loaded (/lib/systemd/system/systemd-remount-fs.service; static)\r\n   Active: active (exited) since Mon 2015-08-31 17:55:19 CEST; 18h ago\r\n     Docs: man:systemd-remount-fs.service(8)\r\n           http://www.freedesktop.org/wiki/Software/systemd/APIFileSystems\r\n  Process: 23 ExecStart=/lib/systemd/systemd-remount-fs (code=exited, status=0/SUCCESS)\r\n Main PID: 23 (code=exited, status=0/SUCCESS)\r\n   CGroup: /system.slice/docker-7b835f5018853634c7ff0aadd4eb3aa884296950ed5f364bbd4db102c0f48660.scope/system.slice/systemd-remount-fs.service\r\n[…]\r\n```"},"comment":{"url":"https://api.github.com/repos/docker/docker/issues/comments/223826083","html_url":"https://github.com/docker/docker/issues/15973#issuecomment-223826083","issue_url":"https://api.github.com/repos/docker/docker/issues/15973","id":223826083,"user":{"login":"paulmenzel","id":9318792,"avatar_url":"https://avatars.githubusercontent.com/u/9318792?v=3","gravatar_id":"","url":"https://api.github.com/users/paulmenzel","html_url":"https://github.com/paulmenzel","followers_url":"https://api.github.com/users/paulmenzel/followers","following_url":"https://api.github.com/users/paulmenzel/following{/other_user}","gists_url":"https://api.github.com/users/paulmenzel/gists{/gist_id}","starred_url":"https://api.github.com/users/paulmenzel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/paulmenzel/subscriptions","organizations_url":"https://api.github.com/users/paulmenzel/orgs","repos_url":"https://api.github.com/users/paulmenzel/repos","events_url":"https://api.github.com/users/paulmenzel/events{/privacy}","received_events_url":"https://api.github.com/users/paulmenzel/received_events","type":"User","site_admin":false},"created_at":"2016-06-05T17:33:56Z","updated_at":"2016-06-05T17:33:56Z","body":"I’ll close the bug, as there won’t be a conclusion.\r\n\r\nFor systemd compatibility I’d still believe, that it should only be mount read-only even in privileged mode. With that, systemd can easily tested in privileged mode, to help users to find out what is wrong, and not change systemd’s behavior in the process. Users needing write permissions can easily remount it writable.\r\n\r\nIssue #18796 might be interesting for people wanting to run systemd inside a container.\r\n\r\nTherefore, I’ll close this report."}}
{"actor":{"display_login":"paulmenzel"}}