On 06/10/2009, at 07.45, Wilhelm Meier wrote:
> Hi again,
>
> Herbert Poetzl schrieb:
>> On Mon, Oct 05, 2009 at 07:46:23PM +0200, Wilhelm Meier wrote:
>>> we use a vserver as terminal-server, quite a normal setup, i think.
>>> The host and guest are both debian lenny.
>>> For some reason we need a polyinstantiated /media directory. i
>>> would like to do this with pam_namespace.
>> hmm .. could you elaborate on that?
>> sounds to me like you want to mount something there?
>
> we use our own netbootet thin-clients (and so called rich-clients).
> The thin-clients can export their local devices (if plugged) via an
> fuse-based filesystem called mediafs. On the terminal-server
> (vserver) a mount is triggered. Up to now the fuse-mount happened in
> $HOME/remote. This is suboptimal for our unskilled users, since they
> are used to have the devices under /media (for the rich-clients or
> locally installed machines).
> So we came across the idea to have a session-namespace per login
> into the terminalserver and use then private mounts on /media, so
> every user only sees his/her thin-client devices.
>
>>> When I use pam_namespace in the pamm-session-stack I get the
>>> following error:
>>> Oct 5 19:28:23 192.168.222.12 kdm:
>>> rich00E0C5600493.intern.kmux.de:1[27525]:
>>> pam_namespace(kdm:session): Unable to unshare from parent
>>> namespace, Operation not permitted
>> assuming that the pam module does an unshare with
>> CLONE_NEWNS, you can permit that with the context
>> capability VXC_NAMESPACE
>
> hmm, the util-vserver from lenny don't support this. I looked into
> the sources (via the link from the great flowers page) and they lack
> of this capability setting (the kernel code contains this flag).
lenny is not so updated on vserver. Compile your own.
JonB
Received on Tue Oct 6 09:26:16 2009