Re: [Vserver] dev in read-only guest / using a ramdisk

From: Herbert Poetzl <herbert_at_13thfloor.at>
Date: Sat 23 Dec 2006 - 20:09:35 GMT
Message-ID: <20061223200935.GB30764@MAIL.13thfloor.at>

On Sat, Dec 23, 2006 at 06:48:55PM +0100, Oliver Welter wrote:
> Hi Folks,
>
> I postet a similar mail to the list about a year ago but didnt find time
> to deal with the issue - so it pops up now again :)

> My Problem: I have my guests root on a read-only partition, var is
> another partition and tmp is a ramdisk. I have the /dev tree on the
> readonly partition at the moment - the result is, that syslog is not
> working because process cant write on the socket....

> I tried to use a symlink for /dev/log to the writable partition -
> seems not to work. If I put the whole /dev directory on the /var
> partition and create a link or use bind-mount I get

> vcontext: open("/dev/null"): Permission denied

yes, because the bind mount probably doesn't exist
when the tools try to write to /dev/null

> On guest start and the init is aborted.

> Perhaps a ramdisk for dev
> (but how to create the necessary nodes on the ramdisk??)

in the same way as you do on any other filesystem:
with mknod :)

> Anybody here can point me to a working solution ?

besides the ramdisk for dev solution you mentioned,
the var version can be made working quite easily by
having the same dev entries twice, i.e. once in
/dev and a second time in /var/dev, so that the
devices will be there before and after the bind
mount

IMHO a more secure solution would be to bind mount
the /dev/log only and keep the entire /dev read only
as that is more secure than having them on var

merry xmas,
Herbert

> merry x.mas and best reagrds
>
> Oliver

> _______________________________________________
> Vserver mailing list
> Vserver@list.linux-vserver.org
> http://list.linux-vserver.org/mailman/listinfo/vserver

_______________________________________________
Vserver mailing list
Vserver@list.linux-vserver.org
http://list.linux-vserver.org/mailman/listinfo/vserver
Received on Sat Dec 23 20:12:47 2006

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Sat 23 Dec 2006 - 20:12:53 GMT by hypermail 2.1.8