Strange mount entries, procfs on net:

Question

On a device I get among others the following strange entries for mount:

none on net:[4026532603] type proc (rw,relatime)
none on net:[4026532424] type proc (rw,relatime)

Any idea what or for what this could be? It is the first time I see procfs used for anything but /proc. And what's this "net:"? Something like sockets or pipes?

I am running an 3.8 rt kernel on an embedded device with some form of BusyBox-based Linux

Potentially relevant entries from /proc/mounts:

rootfs / rootfs rw 0 0
none /proc proc rw,relatime 0 0
none net:[4026532603] proc rw,relatime 0 0
none net:[4026532424] proc rw,relatime 0 0
mgmt /sys sysfs rw,relatime 0 0

Update:

Thanks to @VenkatC's answer I know now that it has something to do with namespaces, as the following output confirms:

$ ls -l /proc/$$/ns
total 0
lrwxrwxrwx 1 root root 0 Nov  3 18:59 ipc -> ipc:[4026531839]
lrwxrwxrwx 1 root root 0 Nov  3 18:59 mnt -> mnt:[4026532733]
lrwxrwxrwx 1 root root 0 Nov  3 18:59 net -> net:[4026532603]
lrwxrwxrwx 1 root root 0 Nov  3 18:59 pid -> pid:[4026531836]
lrwxrwxrwx 1 root root 0 Nov  3 18:59 uts -> uts:[4026531838]

With what kernel version? What kind of device? Is that a virtualized environment of some kind? Is this a “mainstream” Linux or some other operating system based on a Linux kernel like Android? — Gilles 'SO- stop being evil', Sep 29 '15 at 22:44
3.8 rt kernel, an embedded device with some BusyBox-based Linux. — phk, Oct 01 '15 at 09:29
@phk: do you know if there is anything fancy going on like user-namespaces? Does it also appear in `cat /proc/mounts`? — kei1aeh5quahQu4U, Oct 28 '15 at 00:37
@mt_ I edited my post to include the ```/proc/mounts``` output. I will have to do some research on user-namespaces. — phk, Oct 28 '15 at 11:12
@mt_ Since the introduction of per-process mount namespaces in 2.4.19, /proc/mounts is a symlink to /proc/self/mounts and only shows the mounts of the current pid... — Jan, Oct 28 '15 at 19:23
mount -t proc "none net:[4026532603]" /proc; mount -t proc "none net:[4026532424]" /proc Will yield the same result as observed in your /proc/mounts — SHW, Nov 02 '15 at 07:28

score 3 · Answer 1 · edited Oct 07 '21 at 07:34

It looks kind of like a dead nfs connection. or maybe aufs, maybe even something like a RO rootfs (or liveCD) over nfs with aufs.

Note that when you interpret the numbers (4026532603 and 4026532424) as 32-bit integers and then convert them to IP address format, they are:

4026532603 => 240.0.2.72
4026532424 => 240.0.2.251

240.0.0.0/4 is "reserved for future use" (https://www.rfc-editor.org/rfc/rfc6890)...so maybe they're used by/for something on the loopback interface. What kind of embedded device is it?

+----------------------+----------------------+
| Attribute            | Value                |
+----------------------+----------------------+
| Address Block        | 240.0.0.0/4          |
| Name                 | Reserved             |
| RFC                  | [RFC1112], Section 4 |
| Allocation Date      | August 1989          |
| Termination Date     | N/A                  |
| Source               | False                |
| Destination          | False                |
| Forwardable          | False                |
| Global               | False                |
| Reserved-by-Protocol | True                 |
+----------------------+----------------------+

(link to mentioned RFC1112, Section 4)

Does netstat or lsof reveal any connections to/from or anything listening on those IP addresses?

But what I don't get is why this FS type if it's a NFS share. — phk, Oct 31 '15 at 13:10
yeah, the `type proc` is a bit of a puzzler. a bug in your custom kernel perhaps? maybe even just a cosmetic bug that prints the wrong fstype. — cas, Oct 31 '15 at 22:20
OK, so there are no open connections according to ```netstat -l``` but according to ```lsof | grep net``` it's opened several times by different processes (including the login shell). — phk, Nov 02 '15 at 10:49

VenkatC · Accepted Answer · 2015-11-03T04:28:46.390

These entries are related to Network namespaces. From man namespaces(7)

   The /proc/[pid]/ns/ directory
       Each process has a /proc/[pid]/ns/ subdirectory containing one entry
       for each namespace that supports being manipulated by setns(2):
       $ ls -l /proc/$$/ns
       total 0
       lrwxrwxrwx. 1 mtk mtk 0 Jan 14 01:20 ipc -> ipc:[4026531839]
       lrwxrwxrwx. 1 mtk mtk 0 Jan 14 01:20 mnt -> mnt:[4026531840]
       lrwxrwxrwx. 1 mtk mtk 0 Jan 14 01:20 net -> net:[4026531956]
       lrwxrwxrwx. 1 mtk mtk 0 Jan 14 01:20 pid -> pid:[4026531836]
       lrwxrwxrwx. 1 mtk mtk 0 Jan 14 01:20 user -> user:[4026531837]
       lrwxrwxrwx. 1 mtk mtk 0 Jan 14 01:20 uts -> uts:[4026531838]

As you see above net entry refers to a network namespace. I understand the device in question could be running different process with multiple namespaces

I was able to create a test namespace and see similar mounts in /proc/mounts

[cv@cent2 ~]$ ip netns list
netns1
[cv@cent2 ~]$ grep net: /proc/mounts
proc net:[4026532238] proc rw,nosuid,nodev,noexec,relatime 0 0
proc net:[4026532238] proc rw,nosuid,nodev,noexec,relatime 0 0

Network namespaces are used a lot indeed! You might onto something! I will have a look later. — phk, Nov 03 '15 at 09:58

Strange mount entries, procfs on net:

2 Answers2