1

We're updating our product from Centos 6 to Centos 8 and have found a strange behavior when mounting volumes via apache.

A web page provides a UI front end via apache/php to mount/unmount partitions. However, devices mounted via apache/php do not show as "mounted" from the shell.

For example, mounting a USB stick containing a Centos installer via this small program shows the device is mounted, gets unmounted, and the contents can be listed:

<?php 

function runCmd($cmd)
{
    print "$cmd<br />\n";
    exec($cmd, $lines);
    foreach($lines as $l)
    {
        print "$l<br />\n";
    }
    print "<br />\n";
}

runCmd("mount | grep /dev/sd");
runCmd("/usr/bin/sudo -n umount /mnt/usb");
runCmd("mount | grep /dev/sd");

runCmd("/usr/bin/sudo -n /usr/bin/mount /dev/sdb1 /mnt/usb 2>&1");
runCmd("mount | grep /dev/sd");
runCmd("grep sd /etc/mtab");
runCmd("grep sd /proc/mounts");
runCmd("ls /mnt/usb");

?>

WEB PAGE OUTPUT:

mount | grep /dev/sd
/dev/sda1 on /boot type ext4 (rw,relatime)
/dev/sdb1 on /mnt/usb type vfat (rw,relatime,fmask=0022,dmask=0022,codepage=437,iocharset=ascii,shortname=mixed,errors=remount-ro)

/usr/bin/sudo -n umount /mnt/usb

mount | grep /dev/sd
/dev/sda1 on /boot type ext4 (rw,relatime)

/usr/bin/sudo -n /usr/bin/mount /dev/sdb1 /mnt/usb 2>&1

mount | grep /dev/sd
/dev/sda1 on /boot type ext4 (rw,relatime)
/dev/sdb1 on /mnt/usb type vfat (rw,relatime,fmask=0022,dmask=0022,codepage=437,iocharset=ascii,shortname=mixed,errors=remount-ro)

grep sd /etc/mtab
/dev/sda1 /boot ext4 rw,relatime 0 0
/dev/sdb1 /mnt/usb vfat rw,relatime,fmask=0022,dmask=0022,codepage=437,iocharset=ascii,shortname=mixed,errors=remount-ro 0 0

grep sd /proc/mounts
/dev/sda1 /boot ext4 rw,relatime 0 0
/dev/sdb1 /mnt/usb vfat rw,relatime,fmask=0022,dmask=0022,codepage=437,iocharset=ascii,shortname=mixed,errors=remount-ro 0 0

ls /mnt/usb
BaseOS
TRANS.TBL
Torque_Kernel
images
ldlinux.c32
ldlinux.sys
...

However, from the shell, there is nothing showing the device is mounted:

# grep sd /etc/mtab
/dev/sda1 /boot ext4 rw,relatime 0 0
# grep sd /proc/mounts
/dev/sda1 /boot ext4 rw,relatime 0 0
# mount | grep sd
/dev/sda1 on /boot type ext4 (rw,relatime)
# ls /mnt/usb
#

I don't get it... Logging into a new shell also doesn't change anything.

  • Centos 8 Kernel 4.18.0-147.el8.x86_64
  • SELinux is disabled
  • PHP 7.2.11

EDIT I

Some more findings:

  • Volumes mounting via apache are only visible if the command (via /proc/mount, /etc/mtab, or the mount command) is also run in apache
  • Volumes mounted in the shell are visible to both the shell or the same commands executed via httpd.

EDIT II

Following up on the info from Philip Couling, it appears php-fpm is already running:

$ ps aux | grep php
root      1292  0.0  0.2 240252 22512 ?        Ss   Jul02   0:04 php-fpm: master process (/etc/php-fpm.conf)
apache    1484  0.0  0.2 255256 17648 ?        S    Jul02   0:14 php-fpm: pool www
apache    1485  0.0  0.2 255256 17656 ?        S    Jul02   0:14 php-fpm: pool www
apache    1486  0.0  0.2 255256 17716 ?        S    Jul02   0:14 php-fpm: pool www
apache    1487  0.0  0.2 255256 17660 ?        S    Jul02   0:14 php-fpm: pool www
apache    1488  0.0  0.2 255256 17648 ?        S    Jul02   0:14 php-fpm: pool www
apache    3113  0.0  0.2 255268 17748 ?        S    Jul02   0:14 php-fpm: pool www
apache    6214  0.0  0.2 255256 17752 ?        S    Jul02   0:14 php-fpm: pool www
apache    8697  0.0  0.2 255256 17692 ?        S    Jul02   0:13 php-fpm: pool www

There doesn't seem to be anything of interest in /etc/php-fpm.conf or /etc/php-fpm.conf.d/*

5
  • 1
    CentOS8 runs httpd in a private namespace (with its own private /tmp). Since it's such a terrible idea to give httpd the ability to run sudo, I've never tried this, but I suspect what you are seeing is the fact that the mounts are happening in the private namespace.
    – jsbillings
    Jul 2, 2020 at 19:27
  • Thanks, haven't heard of that before. (yes, I know, terrible idea). Any idea how to bypass it?
    – Danny
    Jul 3, 2020 at 3:13
  • Are the mountpoints always the same? Can you set up autofs to mount the devices and just let it automatically mount them when apache httpd tries to stat() the directory?
    – jsbillings
    Jul 3, 2020 at 11:16
  • No, they're always different. The GUI is a front end to mount/unmount NFS/CIFS network volumes, so the remote volume and local mount point will be different. Ditto for IP address... I originally thought it was an NFS problem, but found the strange behavior with USB drives as well.
    – Danny
    Jul 3, 2020 at 12:57

1 Answer 1

0

As per jsbillings this sounds like apache (and PHP) are running inside a mount namespace.

You could try running PHP as it's own server using php-fpm. This is available through yum and there are many tutorials on the web for setting this up. Note I am not certain if Centos's yum package for php-fpm is also placed in a mount namespace so I can't guarantee this will work.


Alternativly, if you can't find a way to [or don't want to] run PHP without putting it in a mount namespace, then you could "break out" of the namespace using nsenter. This command will let you run another command inside another process's mount namespace.

The command line should be running in the same namespace as the root process (pid 1). So executing a command in the command line's namespace should be as simple:

function runCmd($cmd)
{
    print "$cmd<br />\n";
    exec("nsenter -mt 1 $cmd", $lines);
    foreach($lines as $l)
    {
        print "$l<br />\n";
    }
    print "<br />\n";
}

Note: Mounting this way will mean that the new mount is available on the command line but not directly in your PHP process.

3
  • I think all systemd services get their own mount namespace, but maybe only if they have PrivateTmp like the httpd service. I should try experimenting.
    – jsbillings
    Jul 3, 2020 at 15:18
  • @jsbillings I'm not familiar enough with centos to be able to argue with that but it sounds unlikely because the consequences would be pretty severe. See here which turned out to be this issue. I know from experience this cripples the usefulness of SSH. Jul 3, 2020 at 16:20
  • Philip, thank you. Looks like that's what's going on. Don't understand your last note though about the new mount "not directly available in PHP". Using nsenter I mounted the usb and then ran ls -l /mnt/usb in separate command. It worked, so the volume is still visible in both the cmd line and apache.
    – Danny
    Jul 4, 2020 at 1:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .