From: Enrico Scholz (enrico.scholz_at_informatik.tu-chemnitz.de)
Date: Thu 02 Oct 2003 - 11:02:42 BST

• Previous message: Fernando Serto: "[vserver] kernel 2.4.22 patch"
• In reply to: Jacques Gelinas: "re: [vserver] Announce: util-vserver (was: Pre-announce: vserver-base-tools)"

jack_at_solucorp.qc.ca (Jacques Gelinas) writes:

>> * provide secure vrpm/vapt-get wrappers which will be executed outside
>> of the vserver and will not depend on content within the vserver. This
>> is finished to 80% and in the CVS tree.
>
> Package updates have to be done inside a vserver context. Unless you
> do that malicious scripts in the package may break the integrity of
> the root server.

This is solved with overloading rpm's execv() with an LD_PRELOAD
wrapper. This wrapper changes the context and removes capabilities
before doing the real execv().

See [1] for the wrapper itself, and vapt-get*, vrpm* and functions in
[2] for the tools using it.

Stuff like using other (older) versions of rpm is supported also.

Enrico

Footnotes:
[1] http://savannah.nongnu.org/cgi-bin/viewcvs/util-vserver/util-vserver/src/rpm-fake.c?rev=HEAD&content-type=text/vnd.viewcvs-markup

[2] http://savannah.nongnu.org/cgi-bin/viewcvs/util-vserver/util-vserver/scripts/

• Previous message: Fernando Serto: "[vserver] kernel 2.4.22 patch"
• In reply to: Jacques Gelinas: "re: [vserver] Announce: util-vserver (was: Pre-announce: vserver-base-tools)"