unshare system call doesn't work

Question

The following simple C++ program attempts to unshare the mount space, mount a USB storage device (located on /dev/sdd), waits for input, and then umounts that device.

#include <iostream>
#include <stdio.h>
#include <exception>
#include <algorithm>
#include <vector>
#include <limits> 
#include <stdio.h>
#include <sys/wait.h>
#include <unistd.h>

int main()
{
    unshare(CLONE_NEWNS);

    pid_t pid = fork();

    if (0 == pid)
    {
        char * mount_args[] = {"/bin/mount", "--make-rprivate", "/dev/sdd", "/mnt", "-o,ro", "-o,noexec", NULL};

        if (0 > execv("/bin/mount", mount_args))
        {
            perror("execv: ");
            exit(1);
        }
        //this line will never be reached.
        return 0;
    }
    else if (0 < pid)
    {
        //parent process!
        int status = -1;
        wait(&status);

        if (0 == status)
        {
            std::cout << "press ENTER to continue....";
            std::cin.ignore(std::numeric_limits<std::streamsize>::max(), '\n');

            char * umount_args[] = {"/bin/umount", "/mnt", NULL};
            if (0 > execv("/bin/umount", umount_args))
            {
                perror("execv: ");
                exit(1);
            }
        }
        return status;
    }
    else
    {
        //fork error!
        perror("fork!\n");
        exit(1);
    }
    return 0;
}

However, when I run it (after compiling with -fpermissive) the mount is visible from every other process on the system.

My goal , of my mounts being invisible to other user-space processes, is clearly not achieved.

What am I doing wrong?

Edit: this code doesn't work on Ubuntu 16.04 (kernel version 4.4). It does work on Ubuntu 14.04 (kernel version 4.2) - might this have something to do with it?

Maybe you have the right to mount it (according to `/etc/fstab`) but not to unmount it? — Alfe, May 18 '16 at 13:42
You're not checking the return value of `unshare()`, nor of `wait()`... — inetknght, May 18 '16 at 13:43
Why do you use `CLONE_NEWNS`? Also, why _not_ a call to `umount()`? http://linux.die.net/man/2/umount — inetknght, May 18 '16 at 13:46
I do have the right to mount (I run the executable as root). — Young Griff, May 18 '16 at 14:01
I do check the return value of unshare() and wait(), I just didn't add that here in order to simplify the code. — Young Griff, May 18 '16 at 14:02
I use `CLONE_NEWNS` as it is is is the way to unshare mount spaces, according to `man 2 unshare`. — Young Griff, May 18 '16 at 14:12

score 1 · Accepted Answer · answered May 24 '16 at 07:53

1

Turns out the OS default mount option has changed in Ubuntu 16. In order to make unshare(2) work, you need to add the following line to your code (prior to the unshare):

mount("none", "/", NULL, MS_PRIVATE | MS_REC, NULL);

answered May 24 '16 at 07:53

Young Griff

21
5

1

Thank you for this! The equivalent on the commandline, using `mount(8)` and `unshare(1)` is: `mount --make-rprivate none / && unshare --mount program [args]`. – Patrick May 29 '16 at 18:55

unshare system call doesn't work

1 Answers1