On Mon, Dec 13, 2010 at 09:07:39AM +0000, Ben Green wrote:
> Quoting "Jon Bendtsen" <jbendtsen@laerdal.dk>:
>>> Is there some kind of flag I can set to make this work?
>>> What else
>>> should I try?
>> danger! alert! security risk!
>> If you give your guest the mount capability then I am
>> sure it can do what you want to do.
> Don't be so sure!
> The server has long time had a number of insecure
> settings crucial for LTSP operation, ccaps:
> BINARY_MOUNT
> SECURE_MOUNT
> SECURE_REMOUNT
> SET_UTSNAME
> RAW_ICMP
> SYSLOG
> NAMESPACE
> FS_SECURITY
none of the above are insecure per se ...
> And bcaps:
> NET_RAW
> MKNOD
those are insecure and basically render your
system open to all kinds of evil attacks from
inside the guest ....
> I think MKNOD is removable now, but was need for
> building the LTSP chroot.
I doubt that ...
anyway, a quick look at the code shows that
this is not a capability problem ...
I presume your mount syscall returns with
EINVAL not with EPERM (strace will show) and
that can be caused by a bunch of things
my bet would be that it is caused by the
shared namespace/mount propagation configure
by util-vserver to allow to administrate the
guest from outside ...
HTH,
Herbert
> Cheers,
> ==
> From Ben Green
Received on Mon Dec 13 20:13:40 2010