About this list Date view Thread view Subject view Author view Attachment view

From: Herbert Poetzl (herbert_at_13thfloor.at)
Date: Thu 16 Oct 2003 - 01:45:13 BST


On Wed, Oct 15, 2003 at 09:28:05PM +0200, Dariush Pietrzak wrote:
>> For gawd's sake. Do not do that. Giving a vserver the
>> permission to take down the system, just so that you can
>> run a badly-compiled copy of Bind9, is
> In other words, nothing've changed, if you want to run
> bind9 your best bet is to run it chrooted on master server.
> (I prefer to run it chrooted as 'bind' user then to run
> it vserver-chrooted as 'root' ).

hmm, maybe all of you should have a look at the
source, to find that the following is true
(at least for 9.2.2)

named does (on linux only) change the capabilities
in such way, that a non root process can still bind
to reserved ports (< 1024), by calling capset, which
requires that ...

 a) CAP_SETPCAP is present
 b) requested capabilities are a subset of the
    current capabilities ...

this is done with the following capabilities:

 - CAP_DAC_READ_SEARCH
 - CAP_SETGID
 - CAP_SETUID
 - CAP_NET_BIND_SERVICE
 - CAP_SYS_CHROOT
 - CAP_SYS_RESOURCE

all capabilities (including CAP_SETPCAP) are
usually present in a vserver, except for the
CAP_SYS_RESOURCE, which, when granted, will allow
the following:

/* Override resource limits. Set resource limits. */
/* Override quota limits. */
/* Override reserved space on ext2 filesystem */
/* Modify data journaling mode on ext3 filesystem
   (uses journaling resources) */
/* NOTE: ext2 honors fsuid when checking for resource
   overrides, so you can override using fsuid too */
/* Override size restrictions on IPC message queues */
/* Allow more than 64hz interrupts from the real-time clock */
/* Override max number of consoles on console allocation */
/* Override max number of keymaps */

so, if this is okay for you, just add CAP_SYS_RESOURCE
to the capabilities for this vserver, if not, just
don't run bind9 at all, because it will require those
capability regardless of the environment (vserver or not ;)

please update FAQ/mind/whatever ...

best,
Herbert

_______________________________________________
Vserver mailing list
Vserver_at_www.solucorp.qc.ca
http://www.solucorp.qc.ca/mailman/listinfo/vserver


About this list Date view Thread view Subject view Author view Attachment view
[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Thu 16 Oct 2003 - 01:53:55 BST by hypermail 2.1.3