[vserver] which capability for TUNSETIFF?

From: Gregory (Grisha) Trubetskoy <grisha_at_apache.org>
Date: Wed 29 Jul 2009 - 17:22:26 BST
Message-ID: <20090729122153.I83091@grisha.dyndns.org>

I hope I am not missing something obvious, but I do not seem to be able to
figure which capability I need to allow TUNSETIFF.

I am trying to start QEMU with the -net tap option in a vserver context.

I tried all sorts of things, e.g.:

# vcontext --create --xid=10 -- vattribute --bcap NET_ADMIN --bcap SYS_ADMIN --
chbind --nid 10 --ncap TUN_CREATE -- bash

(then from bash i'd start qemu).

strace shows that it is failing at:

open("/dev/net/tun", O_RDWR) = 5
ioctl(5, TUNSETIFF, 0x7fff5c9cf700) = -1 EPERM (Operation not permitted)
write(2, "warning: could not configure /de"..., 72) = 72
close(5) = 0
write(2, "Could not initialize device \'tap"..., 34) = 34
exit_group(1) = ?

# vserver-info
Versions:
                    Kernel: 2.6.30.1-vs2.3.0.36.14-pre4
                    VS-API: 0x00020304
              util-vserver: 0.30.216-pre2841; Jul 29 2009, 09:02:19
Received on Fri Jul 31 02:34:59 2009

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Fri 31 Jul 2009 - 02:35:00 BST by hypermail 2.1.8