About this list Date view Thread view Subject view Author view Attachment view

From: Jacques Gelinas (jack_at_solucorp.qc.ca)
Date: Thu 24 Oct 2002 - 20:45:25 BST


On Wed, 23 Oct 2002 23:25:34 -0500, Burak wrote
> Hello,
>
> What is the risks to set S_CAPS="CAP_SYS_RESOURCE"
> because in vservers users can not use bind() and it is not good somepoint.

The bind daemon needs this to run. This is kind of a flaw (in bind). Without
this capability, a root process is not allowed to raise its resources (ulimit). A non
root process (by default) never has this capability.

Now bind does this

        Ok, we have to make sure we have enought resource

        First we request to raise our capability by setting
        CAP_SYS_RESOURCE

        Then we check if we have enough resource. If not
        we raise them. If ok, we continue.

        Then we lower the capability.

The flaw is that bind, by default on a linux distro, already have all it needs.
So the tests should be inverted somewhat.

So for now, we have to give CAP_SYS_RESOURCE until bind is fixed.

Now, the problem is that on any linux distro, it is not possible to lower
the capability of a process before executing it. So bind author are simply
unaware of the issue. The capability system found on linux, without the
vserver patch is kind of incomplete.

If a program lower its capabilities and then execute a child, the child will
get back all the capabilities. This was done so setuid programs still work
until capabilities may be tagged to executable (a little like the setuid bits).

Unfortunatly, this is not about to happen (imho) because it is not so useful.
What people would like is the ability to say

        OK apache when executed by user jack is allowed to
        bind to port 80.

Currently with capabilities, it is an all or nothing.

Now the effect of giving CAP_SYS_RESOURCE to a vserver is that it is allowed
to raise some limits, which is annoying.

Time to patch bind and to inform the authors

---------------------------------------------------------
Jacques Gelinas <jack_at_solucorp.qc.ca>
vserver: run general purpose virtual servers on one box, full speed!
http://www.solucorp.qc.ca/miscprj/s_context.hc


About this list Date view Thread view Subject view Author view Attachment view
[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Wed 06 Nov 2002 - 07:03:43 GMT by hypermail 2.1.3