Re: [vserver] Vserver and localhost sniffing

From: Daniel Hokka Zakrisson <daniel_at_hozac.com>
Date: Tue 26 Feb 2008 - 12:20:16 GMT
Message-ID: <57302.192.168.102.6.1204028416.squirrel@intranet>

Alejandro Cabrera wrote:
> Dear all, I read that if I have a vserver host with lo (127.0.0.1) and
> some vserver guests with lo 127.0.0.2, 127.0.0.3, etc...there is a
>
> risk that some guest root can use some type of sniffer (cap) and sniff the
> traffic across 127.0.0.1 that is ALL localhost traffic (including
> 127.0.0.2, 127.0.0.3, etc.). This is a serious security problem.
>
>
>
> Here is my question: what happen with localhost sniffing if I assign a
> private IP to the guest localhosts in order to replace 127.0.0.2,
>
> 127.0.0.3, etc. with 192.168.0.2, 192.168.0.3, etc.??? Guest roots can
> still sniff the traffic ???

root in a guest simply cannot sniff traffic at all, if you don't give
him/her too many capabilities. If you give the guest CAP_NET_RAW, root
will be able to see _any_ traffic on _any_ interface, regardless of
restrictions placed on the network context.

-- 
Daniel Hokka Zakrisson
Received on Tue Feb 26 12:25:44 2008
[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Tue 26 Feb 2008 - 12:25:47 GMT by hypermail 2.1.8