Re: [vserver] I'd like to --move it --move it

From: Herbert Poetzl <herbert_at_13thfloor.at>
Date: Mon 13 Dec 2010 - 20:13:27 GMT
Message-ID: <20101213201327.GA13076@MAIL.13thfloor.at>

On Mon, Dec 13, 2010 at 09:07:39AM +0000, Ben Green wrote:
> Quoting "Jon Bendtsen" <jbendtsen@laerdal.dk>:

>>> Is there some kind of flag I can set to make this work?
>>> What else
>>> should I try?

>> danger! alert! security risk!

>> If you give your guest the mount capability then I am
>> sure it can do what you want to do.

> Don't be so sure!
> The server has long time had a number of insecure
> settings crucial for LTSP operation, ccaps:

> BINARY_MOUNT
> SECURE_MOUNT
> SECURE_REMOUNT
> SET_UTSNAME
> RAW_ICMP
> SYSLOG
> NAMESPACE
> FS_SECURITY

none of the above are insecure per se ...

> And bcaps:

> NET_RAW
> MKNOD

those are insecure and basically render your
system open to all kinds of evil attacks from
inside the guest ....

> I think MKNOD is removable now, but was need for
> building the LTSP chroot.

I doubt that ...

anyway, a quick look at the code shows that
this is not a capability problem ...

I presume your mount syscall returns with
EINVAL not with EPERM (strace will show) and
that can be caused by a bunch of things

my bet would be that it is caused by the
shared namespace/mount propagation configure
by util-vserver to allow to administrate the
guest from outside ...

HTH,
Herbert

> Cheers,
> ==
> From Ben Green
Received on Mon Dec 13 20:13:40 2010

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Mon 13 Dec 2010 - 20:13:40 GMT by hypermail 2.1.8