Re: [vserver] pam_namespace inside a vserver

From: Wilhelm Meier <wilhelm.meier_at_fh-kl.de>
Date: Tue 06 Oct 2009 - 10:15:00 BST
Message-ID: <4ACB0A94.6010004@fh-kl.de>

Jon Bendtsen schrieb:
> On 06/10/2009, at 07.45, Wilhelm Meier wrote:
>
>> Hi again,
>>
>> Herbert Poetzl schrieb:
>>> On Mon, Oct 05, 2009 at 07:46:23PM +0200, Wilhelm Meier wrote:
>>>> we use a vserver as terminal-server, quite a normal setup, i think.
>>>> The host and guest are both debian lenny.
>>>> For some reason we need a polyinstantiated /media directory. i would
>>>> like to do this with pam_namespace.
>>> hmm .. could you elaborate on that?
>>> sounds to me like you want to mount something there?
>>
>> we use our own netbootet thin-clients (and so called rich-clients).
>> The thin-clients can export their local devices (if plugged) via an
>> fuse-based filesystem called mediafs. On the terminal-server (vserver)
>> a mount is triggered. Up to now the fuse-mount happened in
>> $HOME/remote. This is suboptimal for our unskilled users, since they
>> are used to have the devices under /media (for the rich-clients or
>> locally installed machines).
>> So we came across the idea to have a session-namespace per login into
>> the terminalserver and use then private mounts on /media, so every
>> user only sees his/her thin-client devices.
>>
>>>> When I use pam_namespace in the pamm-session-stack I get the
>>>> following error:
>>>> Oct 5 19:28:23 192.168.222.12 kdm:
>>>> rich00E0C5600493.intern.kmux.de:1[27525]:
>>>> pam_namespace(kdm:session): Unable to unshare from parent namespace,
>>>> Operation not permitted
>>> assuming that the pam module does an unshare with
>>> CLONE_NEWNS, you can permit that with the context
>>> capability VXC_NAMESPACE
>>
>> hmm, the util-vserver from lenny don't support this. I looked into the
>> sources (via the link from the great flowers page) and they lack of
>> this capability setting (the kernel code contains this flag).
>
> lenny is not so updated on vserver. Compile your own.

Yes: also squeeze is too old ...

now it works ;-)

There is one thing that is different to a plain host: pam_namespace use
the wrong mode/user for the polyinstantiated directory ... strange.

-- 
Wilhelm
Received on Tue Oct 6 10:26:11 2009
[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Tue 06 Oct 2009 - 10:26:13 BST by hypermail 2.1.8