About this list Date view Thread view Subject view Author view Attachment view

From: Kevin Pendleton (kevin_at_roundsphere.com)
Date: Sat 03 Sep 2005 - 17:32:45 BST


Herbert,

This brings up a question I've been meaning to ask. Somehow in the
newer versions of vserver there was a way to securely allow ping to work
now without adding extra capabilities. Is it possible to do the same
thing with other network troubleshooting utilities like traceroute,
without giving up and allowing icmp_raw?

Kevin

Herbert Poetzl wrote:

>On Sat, Sep 03, 2005 at 04:37:39PM +0200, Andreas John wrote:
>
>
>>Hello!
>>
>>I frequently use mtr (a traceroute like util). In a guest it says:
>>
>>bastel:/# mtr www.yahoo.de
>>mtr: unable to get raw sockets.
>>
>>
>
>my crystal ball says that you forgot to set
>the icmp_raw context capability ...
>
>
>
>>I assume that it is generally forbidden by context to "get raw
>>sockets" to prevent guests from doing nasty things? Is there a way to
>>allow getting raw sockets? For special programs?
>>
>>
>
>yes, you can add the CAP_NET_RAW capability
>but that automatically allows guest root to
>sniff on other network traffic ...
>
>HTH,
>Herbert
>
>
>
>>rgds,
>>Andreas John
>>
>>_______________________________________________
>>Vserver mailing list
>>Vserver_at_list.linux-vserver.org
>>http://list.linux-vserver.org/mailman/listinfo/vserver
>>
>>
>_______________________________________________
>Vserver mailing list
>Vserver_at_list.linux-vserver.org
>http://list.linux-vserver.org/mailman/listinfo/vserver
>
>
>
>

_______________________________________________
Vserver mailing list
Vserver_at_list.linux-vserver.org
http://list.linux-vserver.org/mailman/listinfo/vserver


About this list Date view Thread view Subject view Author view Attachment view
[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Sat 03 Sep 2005 - 17:32:06 BST by hypermail 2.1.3