mnexec -c attempts to close all open files except for
standard in/out/error.
Previously we just closed every fd>2, but this seems to take
a long time on docker. So now we read /proc/self/fd to see which
file descriptors are actually in use.
Systemd's default is to mark the root mount as shared and it is
inherited as such by the new mount namespace. This means that any
mounts performed inthe new namespace will be visible by the rest of
the system, breaking privateDirs.
To restore a more sane behaviour, we explicitly mark all mounts
recursively as private, meaning that we will no longer see new mounts
from the root namespace, and our mounts will also not propagate to the
rest of the system.
Fixes#565
The sysfs filesystem is [tagged][1] with a set of namespaces when mounted, taken
from the mounting process. Among other things, this controls which network
devices will show up in /sys/class/net and /sys/class/net/bonding_masters.
Without this change, mininet will not mount sysfs in a node. Attempting to
configure a bond interface in a node will only affect the parent namespace.
This change mounts a new sysfs filesystem in each node. To prevent this mount
from affecting the parent namespace the mount namespace is also unshared.
[1]: https://www.kernel.org/doc/Documentation/filesystems/sysfs-tagging.txt
getopt returns an 'int', so use change datatype of 'c' to match it.
Otherwise, 'c' may hold a value of 255 (0xff), and fail the comparison
with -1 (0xffffffff): while ((c = getopt(...)) != -1)
This bug was uncovered on Ubuntu 13.04 running on ARM, using
arm-linux-gnueabihf-gcc4.7.
I've changed the way things work a bit:
1. netns is replaced by mnexec, a general-purpose mininet helper.
2. For interactive commands, we now use mnexec -p, which prints out
the pid, so we can kill it when someone hits control-C!
3. We close file descriptors for subshells. This might save memory,
but who knows.
4. We detach our subshells from the tty using mnexec -s; thus
control-C should not terminate everything.
5. Given 4, mn -c is now necessary if you kill mininet.
I've changed the way things work a bit:
1. netns is replaced by mnexec, a general-purpose mininet helper.
2. For interactive commands, we now use mnexec -p, which prints out
the pid, so we can kill it when someone hits control-C!
3. We close file descriptors for subshells. This might save memory,
but who knows.
4. We detach our subshells from the tty using mnexec -s; thus
control-C should not terminate everything.
5. Given 4, mn -c is now necessary if you kill mininet.
lantz
Tomasz Buchert
Cody Burkard
Rich Lane
Jose Pedro Oliveira
Zi Shen Lim
Vitaliy Ivanov