Oracle DbNest file system isolation : pivot root/ bind mount

In my previous blog post A first hands on Oracle 20C DbNest (Preview) i encountered some problems when trying to start the PDB nest with the default internal path (parameter DBNEST_PDB_FS_CONF not set) so i was forced to use a custom file system configuration file using the directive “DBNEST_NO_FS_ROOT_MODE” to be able to start it.

It’s time to take a look on what’s going on and what was the problem !

The new file system layout inside a PDB nest is constructed using a combination of :

Bind Mount :”Since Linux 2.4.0 it is possible to remount part of the file hierarchy somewhere else.”

Pivot Root :”changes the root mount in the mount namespace of the calling process. More precisely, it moves the root mount to the directory put_old and makes new_root the new root mount.”

Using strace let’s check what was the problem when opening our PDB nest using the default FS layout (DBNEST_PDB_FS_CONF not set) :

We can see that when bind mounting one the directory “/var/run/nscd” used by the default layout in the new root FS (root_nest) has failed !

This directory is used by the “nscd – name service cache daemon” which was not installed on the server although it is not marked as optional in the default whitelist file “/usr/tmp/log_oracle/dbnest_oracle/stage_DB1019_1359151120/DB1019_DB1019/PDB00003/fs.conf”

After manually creating this directory (empty) every thing is working now !

After mounting all the required directory using Bind mount the old root is changed to the new one using “pivot_root”. The old root is then denied access by bind mounting another directory on it “dbnest_dev_no_perms” on “/.fs”.

Let’s check inside the PDB Nest what it look like 🙂

Indeed it’s completely reshaped !

To disable the pivot root we can use the directive “DBNEST_NO_FS_ROOT_MODE”

When we black list a directory the “dbnest_dev_no_perms” directory will be bind mounted on it :

That’s it 🙂

3 thoughts on “Oracle DbNest file system isolation : pivot root/ bind mount

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s