mnt: retry read-only remounts on EBUSY - #347

A read-only remount of a bind fails with EBUSY if any task holds write access to the mount at that moment.

nsjail mounts each bind read-write first, and only remounts it read-only after the rest of the jail is set up. If a host process accesses files in the jail during that gap and briefly takes write access to the mount, the read-only remount fails with EBUSY and nsjail aborts the launch.

We hit this with a host security agent following a symlink inside a bind. Following a symlink updates its atime, which briefly takes write access, and on an overlayfs lower layer the atime is never stored, so every follow does it.

Kernel level reproduction as root:

sudo bash -c '
mkdir -p /tmp/r/lower/d /tmp/r/upper /tmp/r/work /tmp/r/merged /tmp/r/bind
echo data > /tmp/r/lower/d/real && ln -s real /tmp/r/lower/d/link
mount -t overlay overlay -o lowerdir=/tmp/r/lower,upperdir=/tmp/r/upper,workdir=/tmp/r/work /tmp/r/merged
mount --bind /tmp/r/merged/d /tmp/r/bind
while :; do [ -e /tmp/r/bind/link/x ]; done &
loop=$!
n=0; for i in $(seq 2000); do mount -o remount,bind,ro /tmp/r/bind 2>/dev/null || n=$((n+1)); mount -o remount,bind,rw /tmp/r/bind; done
echo "failed read-only remounts: $n/2000"
kill $loop
umount /tmp/r/bind /tmp/r/merged && rm -rf /tmp/r
'
failed read-only remounts: 140/2000

This PR adds retries to the read-only switch up to 3 times on EBUSY, sleeping 1ms before each retry.