On Sun, Jun 11, 2006 at 01:46:03PM +0200, jean-marc pouchoulon wrote:
> Eugen Leitl a écrit :
> >Can I run BIND9 in a vserver? If yes, is there something I
> >need to be aware of? (One of my nameservers died, so I'm
> >considering virtualizing DNS).
> >
> >
> >
>
> Yes you can but you need to be aware of these capabilities
>
> CAP_MKNOD ( first launch on fedora , you can remove it after )
I would not lightly give that, not even for a
'first' launch, as it might (and probably will)
create devices inside the guest, which will
compromise guest security .. just check /dev
> and CAP_SYS_RESOURCE
not necessary for recent devel kernels, as bind
does not utilize this capability, just checks
that it is there (which is the case on recent
devel)
> in /etc/vservers/vserver_name/bcapabilities.
>
> Or you have to compile bind with --disable-linux-caps
yep, that's the proper way to go for stable
HTH,
Herbert
> _______________________________________________
> Vserver mailing list
> Vserver@list.linux-vserver.org
> http://list.linux-vserver.org/mailman/listinfo/vserver
_______________________________________________
Vserver mailing list
Vserver@list.linux-vserver.org
http://list.linux-vserver.org/mailman/listinfo/vserver
Received on Mon Jun 12 16:37:04 2006