Unable to re-mount /proc in Proxmox 3 containers?

[isparks_curtis]

Recently I discovered that the default /proc mount inside CentOS containers running under Proxmox 3.1 were mounted insecurely:

# mount|grep " /proc"
proc on /proc type proc (rw,relatime)

Under older versions of Proxmox, I was able to correct this by running:

mount -o remount,nosuid,noexec /proc

However, when running under Proxmox 3.1, the above returns:

mount: mount failed

Anyone here aware of a fix for this?

Thanks,

Curtis

 

[t.lamprecht]

Maybe this thread and answer can help you:

http://forum.proxmox.com/threads/23390-Migration-from-openvz-to-LXC?p=117173#post117173

Hi Thomas,

I think I found the issue. I changed the config from lxc with the following line.

lxc.mount.auto = proc sys cgroup

Seams to work now.

Keep you posted as I will run an other migration tonight.

Mr.X

 

[isparks_curtis]

I got distracted for a bit and am finally getting back to this.

Are you saying that lxc.mount.auto can be used in an openvz configuration file? In my googling, I'm only seeing examples of it being used in lxc container configs.

There must be some way to mount /proc in a secure way in OpenVZ.

Curtis

 

[dietmar]

Are you saying that lxc.mount.auto can be used in an openvz configuration file?

Ignore that post (lxc != openvz)

 

[isparks_curtis]

Thanks for the clarification. Perhaps someone over on the OpenVZ forum will know...

https://forum.openvz.org/index.php?t=tree&goto=52226#msg_52226