Mounting new filesystem affects non-recursive bind mounts?

Question

It hasn't always behaved this way, but nowadays I get this inconsistent behaviour. Bind mounts don't copy existing mounts (unless you use --rbind), but new mounts (and unmounts) get copied automatically. It seems like a bug. What causes this?

# mount --bind / /mnt/tmp
# mount | grep /mnt
/dev/mapper/fedora-root on /mnt/tmp type ext4 (rw,relatime,seclabel,data=ordered)
# mount /var/lib/docker
# mount | grep mnt
/dev/mapper/fedora-root on /mnt/tmp type ext4 (rw,relatime,seclabel,data=ordered)
/dev/mapper/fedora-docker on /mnt/tmp/var/lib/docker type ext4 (rw,relatime,seclabel,data=ordered)

This happens on Fedora Workstation 23. I believe Debian 8 is also affected.

It doesn't happen if I boot bash with no other processes, i.e. init=/bin/bash. So it doesn't seem to be inherent to the Linux kernel.

---

It's annoying because this used to be the simplest way to move files from the root filesystem into a new mount point. It would be particularly convenient with SELinux (at least if you use cp?), because the files would be labeled automatically, avoiding the need for restorecon or the like.

Answer 1

You should be able to see that new mounts stop being copied, if you run mount --make-private on the mount point.

The difference when running bash as init, is that the source filesystem has been mounted as private.[*] Whereas booting the full system is effectively running --make-shared. You can see the difference by looking at findmnt -o +PROPAGATION.

Once the root filesystem is mounted as shared, any filesystem mounted directly under it will inherit the same propagation setting.

The root filesystem is being remounted as shared by systemd. This feature was added to systemd around 2012. It was discussed on the amazing Arch Linux wiki.

https://wiki.archlinux.org/index.php?title=Talk:Systemd&oldid=411350#Systemd_defaults_.2F_to_rshared.2C_gotcha

https://github.com/systemd/systemd/commit/b3ac5f8cb98757416d8660023d6564a7c411f0a0

---

While you're reading this, I also recommend learning how to safely disassemble a recursive bind mount. Because on shared mounts, mounts and unmounts propagate in both directions :-).

---

[*] Booting with init=/bin/bash, I saw the filesystems mounted as private. Even though I was still booting with Fedora's dracut initramfs, which runs systemd internally. I'm not 100% sure what was happening here.

Answer 2

I don't know why it happens, but I found a way to avoid it. At least for most filesystems, you can mount them a second time instead of using a bind mount.

EDIT: using this feature has some problems of its own. When you mount the filesystem a second time, any filesystem-specific mount options that you pass are silently ignored.

# mount /dev/mapper/fedora-root /mnt/tmp
# mount | grep /mnt/tmp
/dev/mapper/fedora-root on /mnt/tmp type ext4 (rw,relatime,seclabel,data=ordered)
# mount /var/lib/docker
# mount | grep /mnt/tmp
/dev/mapper/fedora-root on /mnt/tmp type ext4 (rw,relatime,seclabel,data=ordered)