7

On a device I get among others the following strange entries for mount:

none on net:[4026532603] type proc (rw,relatime)
none on net:[4026532424] type proc (rw,relatime)

Any idea what or for what this could be? It is the first time I see procfs used for anything but /proc. And what's this "net:"? Something like sockets or pipes?

I am running an 3.8 rt kernel on an embedded device with some form of BusyBox-based Linux

Potentially relevant entries from /proc/mounts:

rootfs / rootfs rw 0 0
none /proc proc rw,relatime 0 0
none net:[4026532603] proc rw,relatime 0 0
none net:[4026532424] proc rw,relatime 0 0
mgmt /sys sysfs rw,relatime 0 0

Update:

Thanks to @VenkatC's answer I know now that it has something to do with namespaces, as the following output confirms:

$ ls -l /proc/$$/ns
total 0
lrwxrwxrwx 1 root root 0 Nov  3 18:59 ipc -> ipc:[4026531839]
lrwxrwxrwx 1 root root 0 Nov  3 18:59 mnt -> mnt:[4026532733]
lrwxrwxrwx 1 root root 0 Nov  3 18:59 net -> net:[4026532603]
lrwxrwxrwx 1 root root 0 Nov  3 18:59 pid -> pid:[4026531836]
lrwxrwxrwx 1 root root 0 Nov  3 18:59 uts -> uts:[4026531838]
  • With what kernel version? What kind of device? Is that a virtualized environment of some kind? Is this a “mainstream” Linux or some other operating system based on a Linux kernel like Android? – Gilles Sep 29 '15 at 22:44
  • 3.8 rt kernel, an embedded device with some BusyBox-based Linux. – phk Oct 1 '15 at 9:29
  • @phk: do you know if there is anything fancy going on like user-namespaces? Does it also appear in cat /proc/mounts? – mt_ Oct 28 '15 at 0:37
  • @mt_ I edited my post to include the /proc/mounts output. I will have to do some research on user-namespaces. – phk Oct 28 '15 at 11:12
  • @mt_ Since the introduction of per-process mount namespaces in 2.4.19, /proc/mounts is a symlink to /proc/self/mounts and only shows the mounts of the current pid... – Jan Oct 28 '15 at 19:23
3
+50

These entries are related to Network namespaces. From man namespaces(7)

   The /proc/[pid]/ns/ directory
       Each process has a /proc/[pid]/ns/ subdirectory containing one entry
       for each namespace that supports being manipulated by setns(2):
       $ ls -l /proc/$$/ns
       total 0
       lrwxrwxrwx. 1 mtk mtk 0 Jan 14 01:20 ipc -> ipc:[4026531839]
       lrwxrwxrwx. 1 mtk mtk 0 Jan 14 01:20 mnt -> mnt:[4026531840]
       lrwxrwxrwx. 1 mtk mtk 0 Jan 14 01:20 net -> net:[4026531956]
       lrwxrwxrwx. 1 mtk mtk 0 Jan 14 01:20 pid -> pid:[4026531836]
       lrwxrwxrwx. 1 mtk mtk 0 Jan 14 01:20 user -> user:[4026531837]
       lrwxrwxrwx. 1 mtk mtk 0 Jan 14 01:20 uts -> uts:[4026531838]

As you see above net entry refers to a network namespace. I understand the device in question could be running different process with multiple namespaces

I was able to create a test namespace and see similar mounts in /proc/mounts

[cv@cent2 ~]$ ip netns list
netns1
[cv@cent2 ~]$ grep net: /proc/mounts
proc net:[4026532238] proc rw,nosuid,nodev,noexec,relatime 0 0
proc net:[4026532238] proc rw,nosuid,nodev,noexec,relatime 0 0
  • Network namespaces are used a lot indeed! You might onto something! I will have a look later. – phk Nov 3 '15 at 9:58
3

It looks kind of like a dead nfs connection. or maybe aufs, maybe even something like a RO rootfs (or liveCD) over nfs with aufs.

Note that when you interpret the numbers (4026532603 and 4026532424) as 32-bit integers and then convert them to IP address format, they are:

4026532603 => 240.0.2.72
4026532424 => 240.0.2.251

240.0.0.0/4 is "reserved for future use" (https://tools.ietf.org/html/rfc6890)...so maybe they're used by/for something on the loopback interface. What kind of embedded device is it?


+----------------------+----------------------+
| Attribute            | Value                |
+----------------------+----------------------+
| Address Block        | 240.0.0.0/4          |
| Name                 | Reserved             |
| RFC                  | [RFC1112], Section 4 |
| Allocation Date      | August 1989          |
| Termination Date     | N/A                  |
| Source               | False                |
| Destination          | False                |
| Forwardable          | False                |
| Global               | False                |
| Reserved-by-Protocol | True                 |
+----------------------+----------------------+

(link to mentioned RFC1112, Section 4)


Does netstat or lsof reveal any connections to/from or anything listening on those IP addresses?

  • But what I don't get is why this FS type if it's a NFS share. – phk Oct 31 '15 at 13:10
  • yeah, the type proc is a bit of a puzzler. a bug in your custom kernel perhaps? maybe even just a cosmetic bug that prints the wrong fstype. – cas Oct 31 '15 at 22:20
  • OK, so there are no open connections according to netstat -l but according to lsof | grep net it's opened several times by different processes (including the login shell). – phk Nov 2 '15 at 10:49
  • are you using nfs or aufs for home dirs or something? – cas Nov 2 '15 at 10:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.