I am trying to mount the ext4 file system on /mnt into mount_dir which is a temporary directory I created using mkdtemp(2) with MS_SHARED then a remount with MS_PRIVATE, The idea is creating a mount namespace from the /mnt file system and preventing any propagation events from within the namespace to the original file system.

I have tried different flag combinations and only MS_BIND | MS_PRIVATE works, but events seem to still propagate to the original file system.

fprintf(stderr,"-->Mounting file system from base image...");
  if(mount("/mnt", mount_dir, NULL, MS_SHARED , NULL)){
      fprintf(stderr, "%s Failed..%m\n",mount_dir);
      return -1;
    fprintf(stderr,"-->Remounting mount point as MS_PRIVATE...");
    if(mount(NULL, mount_dir, NULL, MS_REMOUNT | MS_PRIVATE, NULL)){
      return -1;
      fprintf(stderr, "Success.\n");
  • Could you clarify what it is that you are asking? – 111--- May 1 at 12:53
  • when i mount /mnt to mount_dir with MS_SHARED flag, the mount system call returns invalid argument, it only works with ( MS_BIND | MS_PRIVATE ), but that will lead the events to propagate to the original mount namespace, which i don't want to happen. – o.awajan May 1 at 18:11

Both mount calls in the code you show need changes. In the first call, when creating the mount, you shouldn't specify the MS_SHARED flag; this is triggering your EINVAL error. Instead, just create the mount without that flag (i.e., the flags argument should be 0). This will create a new mount point with a default propagation type. That type is either MS_SHARED if the parent mount also has shared propagation, or otherwise the propagation type is MS_PRIVATE. (For more details, see the NOTES section in the mount_namespaces(7) manual page.)

In the second mount() call, you don't need the MS_REMOUNT flag, and in fact when you use that flag, the MS_PRIVATE flag is ignored. See the mount(2) manual page (in particular, note the words "with the tests being conducted in the order listed here"):

   A call to mount() performs one of a number  of  general  types  of
   operation,  depending  on  the  bits specified in mountflags.  The
   choice of which operation to perform is determined by testing  the
   bits  set  in  mountflags,  with  the tests being conducted in the
   order listed here:

   *  Remount an existing mount: mountflags includes MS_REMOUNT.

   *  Create a bind mount: mountflags includes MS_BIND.

   *  Change the propagation type of an  existing  mount:  mountflags
      includes  one of MS_SHARED, MS_PRIVATE, MS_SLAVE, or MS_UNBIND‐

   *  Move an existing mount to a new location:  mountflags  includes

   *  Create  a  new  mount:  mountflags  includes  none of the above

Just remove the MS_REMOUNT flag in the second mount() call and you should obtain the result that (I think) you want.

I'm not absolutely sure of the reasons why this two-step process is required, but I suspect the reason is limitations in the design mount() API. That API has steadily had pieces added to it over the years (see the quoted text above for evidence of that), and by the time the mount propagation feature was added (around 2005), this was probably the only backwards compatible way to do it.

  • That is true i double checked and it seems my second mount() is not correct, but still the first mount() call is giving me the invalid argument error when i use MS_SHARED flag or MS_PRIVATE flag from the first time without having to change the propagation type later. As for my objective from this code, I have an ext4 filesystem mounted at /mnt and i want to create a mount namespace where my process have the filesystem mounted at /mnt, without propagating any changes to /mnt. Basically a sandbox functionality. – o.awajan May 3 at 11:20
  • @o-awajan Your original question is rather imprecise: it implied that the problem was the MS_PRIVATE flag in the second mount() call. If I now understand you correctly, you should (1) create the new mount without MS_SHARED or MS_PRIVATE and then (2) modify the mount as I suggested, using just the MS_PRIVATE flag. – mtk May 3 at 23:25
  • I just tried and it works, thanks and sorry for not being clear in the question, also if I may, why can't I mount from the start with MS_PRIVATE? – o.awajan May 4 at 7:22
  • @o.awajan I added some further text to my answer, including some text that addresses your last comment. – mtk May 4 at 13:06
  • Thanks for the help. – o.awajan May 5 at 5:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.