Re: [Vserver] chroot barrier problem when consolidating var and etc

From: Daniel Hokka Zakrisson <daniel_at_hozac.com>
Date: Fri 02 Mar 2007 - 19:30:19 GMT
Message-ID: <33558.192.168.101.6.1172863819.squirrel@intranet>

Martin Fick wrote:
> I have run into a chroot barrier problem when
> consolidating a vserver's etc and var files under the
> same parent directory. When the
> /etc/init.d/util-vserver script runs it sets a chroot
> barrier on the parent of the vserver's var directory.

That's a Debian-thing, although it is a good idea.

> If the etc and var directories share this parent the
> barrier somehow prevents the vserver from accessing
> its etc files. Specifically, when starting the
> verserver, I get this error:
>
> vlimit: fstat("/etc/vservers/<server-name>/rlimits"):
> Permission denied
>
>
> My layout is the following:
>
> /etc/vservers/<server-name> ->
> /vservers/<server-name>/etc
> /var/lib/vservers/<server-name> ->
> /vservers/<server-name>/var
>
> /vservers/<server-name>/etc
> /vservers/<server-name>/var
>
> I have seen this error reported by others who have
> also symlinked their etc directory, but I have not
> seen any good solution given to this problem. My
> workaround has been to simply put the vserver's var
> directory in a subdirectory like this instead.

The simpler version is to use something like:
/vservers/etc/<guest>
/vservers/var/<guest>
where only the var directory needs to have the barrier set.

> Is this normal behavior, should I just not be doing
> this? Is my workaround a security problem? Is there
> potentially a simple fix that should be implemented in
> the way that the standard vserver directories are
> layed out to allow a setup like this to function
> without my workaround?

You want to have the barrier set, otherwise the guest will be able to
break out of the chroot and into other guests (and with your setup, change
the configuration to give the guest more privileges).

-- 
Daniel Hokka Zakrisson
_______________________________________________
Vserver mailing list
Vserver@list.linux-vserver.org
http://list.linux-vserver.org/mailman/listinfo/vserver
Received on Fri Mar 2 20:08:02 2007
[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Fri 02 Mar 2007 - 20:08:07 GMT by hypermail 2.1.8