Re: [vserver] pam_namespace inside a vserver

From: Wilhelm Meier <wilhelm.meier_at_fh-kl.de>
Date: Tue 06 Oct 2009 - 06:45:55 BST
Message-ID: <4ACAD993.8050405@fh-kl.de>

Hi again,

Herbert Poetzl schrieb:
> On Mon, Oct 05, 2009 at 07:46:23PM +0200, Wilhelm Meier wrote:
>
>> we use a vserver as terminal-server, quite a normal setup, i think.
>> The host and guest are both debian lenny.
>
>> For some reason we need a polyinstantiated /media directory. i would
>> like to do this with pam_namespace.
>
> hmm .. could you elaborate on that?
> sounds to me like you want to mount something there?

we use our own netbootet thin-clients (and so called rich-clients). The
thin-clients can export their local devices (if plugged) via an
fuse-based filesystem called mediafs. On the terminal-server (vserver) a
mount is triggered. Up to now the fuse-mount happened in $HOME/remote.
This is suboptimal for our unskilled users, since they are used to have
the devices under /media (for the rich-clients or locally installed
machines).
So we came across the idea to have a session-namespace per login into
the terminalserver and use then private mounts on /media, so every user
only sees his/her thin-client devices.

>
>> When I use pam_namespace in the pamm-session-stack I get the following
>> error:
>
>> Oct 5 19:28:23 192.168.222.12 kdm:
>> rich00E0C5600493.intern.kmux.de:1[27525]: pam_namespace(kdm:session):
>> Unable to unshare from parent namespace, Operation not permitted
>
> assuming that the pam module does an unshare with
> CLONE_NEWNS, you can permit that with the context
> capability VXC_NAMESPACE

hmm, the util-vserver from lenny don't support this. I looked into the
sources (via the link from the great flowers page) and they lack of this
capability setting (the kernel code contains this flag).

>> It is not clear to me if this is possible, because it would
>> result in somehow nested namespace: the new namespace inside the
>> vserver-namespace?
>
> a Linux-VServer guest consists of several namespaces,
> the filesystem/mount namespace is only one of them
> and more than that, it is fully hierarchical, so that
> should be fine :)
>
>> Any hints how to do this?
>
> get recent and working kernel, use VXC_NAMESPACE

not possible, see above

  be happy :)

yes, I am!

>
> best,
> Herbert
>
> if you or your company use and like the Linux-VServer project,
> why not consider donating hardware or money, or getting a
> service contract with the developers to ensure that it will
> live on and continue to provide high quality free software?
>
>> --
>> Wilhelm

-- 
Wilhelm Meier
An der Sägemühle 9
D-66459 Kirkel
Received on Tue Oct 6 06:57:04 2009
[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Tue 06 Oct 2009 - 06:57:07 BST by hypermail 2.1.8