Why remount of /proc/sys is not global or does not persist in network namespace inside LXC

Question

I have host running RHEL-7.2. Inside that running LXC. Inside LXC creating network namespaces. Inside the namespace changing sysctl variables was failing (as root):

$ ip netns add testns
$ ip netns exec testns bash
$ sysctl net.ipv6.conf.all.disable_ipv6=1
sysctl: setting key "net.ipv6.conf.all.disable_ipv6": Read-only file system

If I remount /proc/sys for RW in a shell and then sysctl -w inside same shell, then it does work.

$ ip netns exec testns bash
$ mount -o remount,rw /proc/sys
$ sysctl net.ipv6.conf.all.disable_ipv6=1
net.ipv6.conf.all.disable_ipv6 = 1

I then start 2nd shell and enter netns and /proc/sys appears Read-ONLY for that shell, but remains writable within the 1sh shell. This puzzles me. The affect of changing values by first shell is visible to the second shell.

I was trying to add remounting to the provisioning script, but this issue gets in the way.

$ ip netns exec testns sysctl net.ipv6.conf.all.disable_ipv6=1
sysctl: setting key "net.ipv6.conf.all.disable_ipv6": Read-only file system

$ ip netns exec testns sh -c \
>   'mount -o remount,rw /proc/sys && sysctl net.ipv6.conf.all.disable_ipv6=1'
net.ipv6.conf.all.disable_ipv6 = 1

$ ip netns exec testns sysctl net.ipv6.conf.all.disable_ipv6=0
sysctl: setting key "net.ipv6.conf.all.disable_ipv6": Read-only file system

Note that I can do this sysctl change on host and in LXC's default namespace without any problems. If I create a namespace on the host directly I do not have this problem. I only run into /proc/sys being read-only inside the namespace inside LXC.

My questions here are:

Q1. I would like /proc/sys inside the namespace inside LXC to remain permanently mounted with RW so I can set sysctl vars anytime.

Q2. I would like to understand why it behaves the way it does. It seems /proc/sys mount is somehow per process, or per setns system call? man ip-netns talks about bind mount for /etc/netns/<name>/file but I don't see anything about /proc. Did I miss something obvious?

Update

I found what is most likely to be the answer to my Q2. First experimentally and then in man ip-netns:

ip netns exec automates handling of this configuration, file convention for network namespace unaware applications, by creating a mount namespace and bind mounting all of the per network namespace configure files into their traditional location in /etc.

So every time ip netns exec creates a new mount namespace but /proc/sys happens to become the victim of whatever mount options it got where ever it got them from. My best guess is I need to find what causes ip netns exec to mount bind /proc/sys in read only mode under LXC, which probably will answer my question Q1.

Answer 1

I found something that works for me. This solution might be bad idea for those that care about security such as preventing container interfering with the host. I do not really understand full consequences of my solution. I run only my own code inside LXCs with Jenkins tests, so for me it's not an issue.

I found here: https://libvirt.org/drvlxc.html#fsmounts :

The following special mounts are setup by libvirt

/proc/sys the host "/proc/sys" bind-mounted read-only

I still don't understand why inside default network namespace inside LXC I can set sysctl but inside other network namespaces I can not.

I added explicit /proc/sys mount in the container config XML:

<devices>
...
  <filesystem type='mount' accessmode='passthrough'>
    <source dir='/proc/sys/'/>
    <target dir='/proc/sys/'/>
  </filesystem>

This allowed me to set sysctl both inside the LXC container default and additional namespaces. I was afraid that setting inside LXC would also affect the host, but it does not. Now all network namespaces (host, LXC default, LXC custom) have their independent writable (by root) sysctl variables without having to remount every time. Or at least that what sysctl query reports.