linux - Bind mount not visible when created from a CGI script in Apache -

my application allows user bind mount source directory target mount point. working correctly except mount not exist outside process corrected it.

i have boiled down issue simple script.

#!/bin/bash echo "content-type: text/html" echo "" echo ""  echo "<p>hello</p>"  echo "<p>results pid #{$$}:</p>" echo "<ul>"   c="sudo mkdir /shares/target"   echo "<li>executed '$c', results: " $(eval $c) "</li>"    c="sudo mount --bind /root/source /shares/target"   echo "<li>executed '$c', results: " $(eval $c) "</li>"    c="sudo mount | grep shares"   echo "<li>executed '$c', results: " $(eval $c) "</li>"    c="sudo cat /proc/mounts | grep shares"   echo "<li>executed '$c', results: " $(eval $c) "</li>" echo "</ul>" 

the first 2 commands create mount point , execute mount. last 2 commands verify result. script executes without issue. however, mount not visible or available in separate shell process. executing last 2 commands in separate shell not show mount being available. if attempt execute "rm -rf /shares/target" "rm: cannot remove '/shares/target/': device or resource busy”. executing "losf | grep /shares/target" generates no output. in seperate shell have switch apache user mount still not available. have verified apache process not in chroot logging output of "ls /proc/$$/root". points "/".

i running:

• apache 2.4.6
• centos 7
• httpd-2.4.6-31.el7.centos.1.x86_64
• httpd-tools-2.4.6-31.el7.centos.1.x86_64

i turned logging debug error_log indicates nothing.

thanks in advance.

this behavior due following line in httpd.service systemd unit:

privatetmp=true 

from systemd.exec(5) man page:

   privatetmp=        takes boolean argument. if true, sets new file        system namespace executed processes , mounts        private /tmp , /var/tmp directories inside not        shared processes outside of namespace.        [...]        note using setting disconnect propagation of        mounts service host (propagation in        opposite direction continues work). means        setting may not used services shall able        install mount points in main mount namespace. 

in other words, mounts made httpd , child processes not visible other processes on host.

the privatetmp directive useful security perspective, described here:

/tmp traditionally has been shared space local services , users. on years has been major source of security problems multitude of services. symlink attacks , dos vulnerabilities due guessable /tmp temporary files common. isolating service's /tmp rest of host, such vulnerabilities become moot.

you can safely remove privatetmp directive unit file (well, don't modify unit file -- create new 1 @ /etc/systemd/system/httpd.service, systemctl daemon-reload, systemctl restart httpd).