[patch v1] Allow for unpriviledged nested containers

[Florian Weimer]

* DJ Delorie:

> Florian Weimer <fweimer@redhat.com> writes:
>> Have you tried a bind mount of the existing /proc into the chroot (from
>> the outside of that chroot)?
>
> That's an interesting idea, but the directory it (and /sys, /dev, etc,
> eventually, I suppose) needs to be mounted on doesn't exist until we're
> late into "make check" and rsync'ing the pristine test container to the
> working test container.  And we delete and rebuild that container as
> needed.  It would be a lot of messy logic to pre-mount that.

Huh.  We already do this for various parts of /dev.  I had something
like this in mind (untested):

diff --git a/support/test-container.c b/support/test-container.c
index 94498d3901..ff91a12860 100644
--- a/support/test-container.c
+++ b/support/test-container.c
@@ -1094,6 +1094,13 @@ main (int argc, char **argv)
   trymount (support_srcdir_root, new_srcdir_path);
   trymount (support_objdir_root, new_objdir_path);
 
+  /* It may not be possible to mount /proc directly.  */
+  {
+    char *new_proc = concat (new_root_path, "/proc", NULL);
+    xmkdirp (new_proc);
+    trymount ("/proc", new_proc);
+  }
+
   xmkdirp (concat (new_root_path, "/dev", NULL), 0755);
   devmount (new_root_path, "null");
   devmount (new_root_path, "zero");
@@ -1163,11 +1170,6 @@ main (int argc, char **argv)
 
   maybe_xmkdir ("/tmp", 0755);
 
-  /* Now that we're pid 1 (effectively "root") we can mount /proc  */
-  maybe_xmkdir ("/proc", 0777);
-  if (mount ("proc", "/proc", "proc", 0, NULL) < 0)
-    FAIL_EXIT1 ("Unable to mount /proc: ");
-
   /* We map our original UID to the same UID in the container so we
      can own our own files normally.  */
   UMAP = open ("/proc/self/uid_map", O_WRONLY);

Thanks,
Florian