2006/1/19, sukrit <firstname.lastname@example.org>:
> Is it firstly possible to remove root user from a vserver so as to
> secure it? Secondly is there documentation of this? Also, any known side
Well, yes and no.
No, you can't really prevent *all* processes from having uid==0 (what
about vserver enter? you'd want to block it too?).
Yes, you can strip enough capabilities to lock down the vserver heavily.
Known side effects - things break :) e.g. if you remove CAP_MOUNT you
can no longer mount filesystems etc. so programs that expect this
feature don't work.
I'm usually using a set of bcapabilities like this:
plus quota_ctl in ccapabilities.
Vserver mailing list
Received on Thu Jan 19 13:48:41 2006