Thanks for the suggestion! But isn't Linux VServer 2.3 still a development release? When will it be considered stable and recommended for production use?
I was really recommending a patch for a stable (2.2) releases where this functionality is not available at the moment. So are you recommending to wrap this patch in an extra capability? If so would NET_BROADCAST from Posix caps cover this capability? Or would you really recommend defining a new network context capability.
Thanks in advance!
Sincerely,
Artem Dmytrenko
--- On Fri 03/28, Daniel Hokka Zakrisson < daniel@hozac.com > wrote:
From: Daniel Hokka Zakrisson [mailto: daniel@hozac.com]
To: vserver@list.linux-vserver.org
Date: Fri, 28 Mar 2008 06:42:12 +0100 (CET)
Subject: Re: [vserver] Multicast support in vserver
dash700@excite.com wrote:> Hello VServer experts!>> I'm working on a project that uses VServer to provide application> isolation functionality. As part of the development we came across a> problem supporting multicast binding from inside vserver unless NET_ADMIN> capability is turned on. It appears that VServer treats multicast> addresses as any other network address. So in order to allow multicast> addresses in vserver they need to be a part of NX_INFO list. This list can> become quite large if all multicast address space is included.If you use Linux-VServer 2.3, you could just do naddress --nid <guest>--add --mask 224.0.0.0/4. I don't see how CAP_NET_ADMIN would let you getaround the address restrictions though.> I've looked at af_inet.c code and it appears that it's easy to provide> multicast support if multicast addresses are differentiated from the rest> of the address space. I believe this is safe to do because multicast> addresses are handled differently by the kernel
than normal IP addresses.> I've attached a patch against a stable VServer release and 2.6.22 kernel> that provides multicast support to vservers without NET_ADMIN capability.>> Would it be possible to review this patch for any criticism and possibly> inclusion into upcoming stable VServer release if it is useful?>> multicast-plain.diff : Kernel patchThis would need a network context capability, at least.> demo_mc_bind.c : C program that demonstrates lack of multicast support> inside VServer>> Thank you in advance!>> Sincerely,> Artem Dmytrenko-- Daniel Hokka Zakrisson
_______________________________________________
Join Excite! - http://www.excite.com
The most personalized portal on the Web!
Received on Fri Mar 28 20:41:23 2008