Re: [Vserver] Re: Re: Re: Re: Re: Re: java crash in vserver...

From: Herbert Poetzl <herbert_at_13thfloor.at>
Date: Wed 09 May 2007 - 22:25:29 BST
Message-ID: <20070509212529.GA4943@MAIL.13thfloor.at>

On Wed, May 09, 2007 at 10:39:06AM +0200, Thomas Besser wrote:
> Asier Baranguán wrote:
>
> > Thomas Besser escribió:
> >
> >>> Guest have the CAP_NET_BROADCAST and CAP_SYS_RESOURCE enabled. Perhaps
> >>> you can try with other kernel.
> >>
> >> I tried several kernels till now.
> >>
> >> Whats about this CAP_SYS_RESOURCE and where/how to set it? In host or
> >> guest?
> >
> > You must write it in the bcapabilities file under the vserver
> > configuration folder. It's as simple as:
> >
> > root # echo CAP_SYS_RESOURCE > /etc/vservers/<vserver name>/bcapabilities
> >
> > Or if you have the file, add it:
> >
> > root # echo CAP_SYS_RESOURCE >> /etc/vservers/<vserver name>/bcapabilities
> >
> > And restart the vserver. You have some info about the capabilities and the
> > meaning of this files in the linux-vserver page.
> >
> > http://linux-vserver.org/Capabilities_and_Flags
> >
> > http://linux-vserver.org/util-vserver:Capabilities_and_Flags
>
> Thanx, tried CAP_SYS_RESOURCE. Nothing changed.

not unexpected, giving any capabilities beyond the
default set can be considered a (sometimes severe)
reduction in guest security (i.e. you are handing
over control to host specific parts which can be
used either for DoS or in most cases direct control
over host specific entities)

CAP_NET_BROADCAST is not critical, as it is currently
unused :)

best,
Herbert
 
> Regards
> Thomas
>
>
> _______________________________________________
> Vserver mailing list
> Vserver@list.linux-vserver.org
> http://list.linux-vserver.org/mailman/listinfo/vserver
_______________________________________________
Vserver mailing list
Vserver@list.linux-vserver.org
http://list.linux-vserver.org/mailman/listinfo/vserver
Received on Wed May 9 22:51:29 2007

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Wed 09 May 2007 - 22:51:31 BST by hypermail 2.1.8