Linux - understanding the mount namespace & clone CLONE_NEWNS flag -

i reading mount & clone man page. want clarify how clone_newns effects view of file system child process.

(file hierarchy)

lets consider tree directory hierarchy. lets says 5 & 6 mount points in parent process. clarified mount points in question.

so understanding : 5 & 6 mount points means mount command used 'mount' file systems (directory hierarchies) @ 5 & 6 (which means there must directory trees under 5 & 6 well).

from mount man page :

 mount namespace set of filesystem mounts visible process.  

from clone man page :

every process lives in mount namespace.  namespace of process data  (the set of mounts) describing file hierarchy seen process.  after  fork(2) or clone() clone_newns flag not set, child lives in  same mount namespace parent. 

also :

after clone() clone_newns flag set, cloned child started in  new mount namespace, initialized copy of namespace of parent. 

now if use clone() clone_newns create child process, mean child exact copy of mount points in tree (5 & 6) , still able access rest of original tree ? mean child mount 5 & 6 @ will, without effecting what's mounted @ 5 or 6 in parent process's mount namespace.

if yes, mean child mount / unmount different directory 5 or 6 , effect what's visible parent process ?

thanks.

the “mount namespace” of process set of mounted filesystems sees. once go traditional situation of having 1 global mount namespace having per-process mount namespaces, must decide when creating child process clone().

traditionally, mounting or unmounting filesystem changed filesystem seen processes: there 1 global mount namespace, seen processes, , if change made (e.g. using mount command) processes see change irrespective of relationship mount command.

with per-process mount namespaces, child process can have different mount namespace parent. question arises:

should changes mount namespace made child propagate parent?

clearly, functionality must @ least supported and, indeed, must default. otherwise, launching mount command effect no change (since filesystem seen parent shell unaffected).

equally clearly, must possible necessary propagation suppressed, otherwise can never create child process mount namespace differs parent, , have 1 global mount namespace again (the filesystem seen init).

thus, must decide when creating child process clone() whether child process gets own copy of data mounted filesystems parent, can change without affecting parent, or gets pointer same data structures parent, can change (necessary changes propagate back, when launch mount shell).

if clone_newns flag passed clone(), child gets copy of parent's mounted filesystem data, can change without affecting parent's mount namespace. otherwise, gets pointer parent's mount data structures, changes made child seen parent (so mount command can work).

now if use clone clone_newns create child process, mean child exact copy of mount points in tree (5 & 6) , still able access rest of original tree ?

yes. sees exact same tree parent after call clone().

does mean child mount 5 & 6 @ will, without effecting what's mounted @ 5 or 6 in parent process's mount namespace.

yes. since you've used clone_newns, child can unmount 1 device 5 , mount device there, , (and children) see changes. no other process can see changes made child in case.

if yes, mean child mount / unmount different directory 5 or 6 , effect what's visible parent process ?

no. if you've used clone_newns, changes made in child cannot propagate parent.

if haven't used clone_newns, child have received pointer same mount namespace data parent, , changes made child seen process shares data structures, including parent. (this case when new child created using fork().)