mount-setup: change system mount propagation to shared by default

In order to make containers work nicely out of the box it is highly
desirable to have the mount propagation mode for the root fs is set as
"shared" by default so that containers receive system mounts by default.
(See mount --make-shared for more information).

As it is unlikely that the kernel will change the default to "shared"
for this, do this early at boot-up from PID 1. Setups which prefer the
default of "private" should undo this change via invoking "mount
--make-private /" or a similar command after boot.

In the long run /etc/fstab should take the propagation mode as a mount
option like any other, so that this may be used to change the default
mode. However, if fstab is not around or doesn't list / we still should
default to shared as propagation mode, hence this change now.

diff --git a/TODO b/TODO
index 6dc36cb99d052bdde2b11bcae83f050ef8e1df67..6d99afe63ba2c4591f1c1d8896ac9c922020777f 100644 (file)
--- a/TODO
+++ b/TODO
@@ -49,8 +49,6 @@ Features:
 
 * .journal~ files should be parsed too
 
 
 * .journal~ files should be parsed too
 

-* use mount --make-shared on / by default
-

 * allow services with no ExecStart= but with an ExecStop=
 
 * add proper journal support to "systemctl --user status ..."
 * allow services with no ExecStart= but with an ExecStop=
 
 * add proper journal support to "systemctl --user status ..."

diff --git a/src/core/mount-setup.c b/src/core/mount-setup.c
index c10c6dad1c853f5c4fe3f4310a01de2ebfd7be30..e86a89321e91c169af1afe57b1f7a48d07d035f1 100644 (file)
--- a/src/core/mount-setup.c
+++ b/src/core/mount-setup.c
@@ -400,6 +400,15 @@ int mount_setup(bool loaded_policy) {
          * udevd. */
         dev_setup();
 
          * udevd. */
         dev_setup();
 

+        /* Mark the root directory as shared in regards to mount
+         * propagation. The kernel defaults to "private", but we think
+         * it makes more sense to have a default of "shared" so that
+         * nspawn and the container tools work out of the box. If
+         * specific setups need other settings they can reset the
+         * propagation mode to private if needed. */
+        if (mount(NULL, "/", NULL, MS_REC|MS_SHARED, NULL) < 0)
+                log_warning("Failed to set up the root directory for shared mount propagation: %m");
+

         /* Create a few directories we always want around */
         mkdir_label("/run/systemd", 0755);
         mkdir_label("/run/systemd/system", 0755);
         /* Create a few directories we always want around */
         mkdir_label("/run/systemd", 0755);
         mkdir_label("/run/systemd/system", 0755);