In an application, I need to temporarily "switch" into a specific mount namespace to check some things inside it in
/proc, then switch back to the mount namespace my application was started with, then switch to another mount namespace, etc, etc.
The application is started with the "root" mount namespace, and under the root user (two different root concepts here!).
Under the hood,
setns() is used to switch forth and back. On top of that I use Zalando's nsenter Python library. This library allows to "enter" a specific namespace by first opening an fd to
/proc/self/ns/[nstype] to be used later to switch back. Then, it takes the path to a namespace in the filesystem, opens an fd from that, and joins via
setns(fd, 0). Afterwards, the first fd is used to join back the original namespace, using
setns() again. This works beautifully for, say, network namespaces.
But for hopping mount namespaces, it fails when trying to reenter the same mount namespace again, after having left it before. Hopping here means: my application enters one mount namespace, does some work, returns to its original mount namespace, switches into a mount namespace again, switches back, etc.
For what it is worth: the trouble seems to step in with containers in containers.
Is there some restriction on switching mount namespaces? Possibly related to user namespaces? The mount namespace man page mentions some relation to user namespaces, but I don't understand how a different user namespace active when the mount namespace for a container was created does affect my application from the root user namespace with root rights with respect to switching to and away from those container mount namespaces. Does switching into such a mount namespace makes my application loose rights, so it fails later?
So, with a nod to the giants: is mount namespace hopping considered harmful?