I have host running RHEL-7.2. Inside that running LXC. Inside LXC creating network namespaces. Inside the namespace changing sysctl
variables was failing (as root):
$ ip netns add testns
$ ip netns exec testns bash
$ sysctl net.ipv6.conf.all.disable_ipv6=1
sysctl: setting key "net.ipv6.conf.all.disable_ipv6": Read-only file system
If I remount /proc/sys
for RW in a shell and then sysctl -w
inside same shell, then it does work.
$ ip netns exec testns bash
$ mount -o remount,rw /proc/sys
$ sysctl net.ipv6.conf.all.disable_ipv6=1
net.ipv6.conf.all.disable_ipv6 = 1
I then start 2nd shell and enter netns and /proc/sys
appears Read-ONLY for that shell, but remains writable within the 1sh shell. This puzzles me. The affect of changing values by first shell is visible to the second shell.
I was trying to add remounting to the provisioning script, but this issue gets in the way.
$ ip netns exec testns sysctl net.ipv6.conf.all.disable_ipv6=1
sysctl: setting key "net.ipv6.conf.all.disable_ipv6": Read-only file system
$ ip netns exec testns sh -c \
> 'mount -o remount,rw /proc/sys && sysctl net.ipv6.conf.all.disable_ipv6=1'
net.ipv6.conf.all.disable_ipv6 = 1
$ ip netns exec testns sysctl net.ipv6.conf.all.disable_ipv6=0
sysctl: setting key "net.ipv6.conf.all.disable_ipv6": Read-only file system
Note that I can do this sysctl
change on host and in LXC's default namespace without any problems. If I create a namespace on the host directly I do not have this problem. I only run into /proc/sys
being read-only inside the namespace inside LXC.
My questions here are:
Q1. I would like /proc/sys
inside the namespace inside LXC to remain permanently mounted with RW so I can set sysctl vars anytime.
Q2. I would like to understand why it behaves the way it does. It seems /proc/sys
mount is somehow per process, or per setns
system call? man ip-netns
talks about bind mount for /etc/netns/<name>/file
but I don't see anything about /proc
. Did I miss something obvious?
Update
I found what is most likely to be the answer to my Q2.
First experimentally and then in man ip-netns
:
ip netns exec automates handling of this configuration, file convention for network namespace unaware applications, by creating a mount namespace and bind mounting all of the per network namespace configure files into their traditional location in
/etc
.
So every time ip netns exec
creates a new mount namespace but /proc/sys
happens to become the victim of whatever mount options it got where ever it got them from. My best guess is I need to find what causes ip netns exec
to mount bind /proc/sys
in read only mode under LXC, which probably will answer my question Q1.