Re: [Vserver] bind9 in vserver

From: Herbert Poetzl <herbert_at_13thfloor.at>
Date: Mon 12 Jun 2006 - 16:36:41 BST
Message-ID: <20060612153641.GB6742@MAIL.13thfloor.at>

On Sun, Jun 11, 2006 at 01:46:03PM +0200, jean-marc pouchoulon wrote:
> Eugen Leitl a écrit :
> >Can I run BIND9 in a vserver? If yes, is there something I
> >need to be aware of? (One of my nameservers died, so I'm
> >considering virtualizing DNS).
> >
> >
> >
>
> Yes you can but you need to be aware of these capabilities
>
> CAP_MKNOD ( first launch on fedora , you can remove it after )

I would not lightly give that, not even for a
'first' launch, as it might (and probably will)
create devices inside the guest, which will
compromise guest security .. just check /dev

> and CAP_SYS_RESOURCE

not necessary for recent devel kernels, as bind
does not utilize this capability, just checks
that it is there (which is the case on recent
devel)

> in /etc/vservers/vserver_name/bcapabilities.
>
> Or you have to compile bind with --disable-linux-caps

yep, that's the proper way to go for stable

HTH,
Herbert

> _______________________________________________
> Vserver mailing list
> Vserver@list.linux-vserver.org
> http://list.linux-vserver.org/mailman/listinfo/vserver
_______________________________________________
Vserver mailing list
Vserver@list.linux-vserver.org
http://list.linux-vserver.org/mailman/listinfo/vserver
Received on Mon Jun 12 16:37:04 2006

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Mon 12 Jun 2006 - 16:37:08 BST by hypermail 2.1.8