Re: [vserver] setattr for vserver over NFS

From: Dan Urist <durist_at_ucar.edu>
Date: Wed 14 Dec 2011 - 16:14:24 GMT
Message-ID: <20111214091424.5b49f418@atkinson>

Can you tell me (or give me a pointer to some docs) what mechanism has
replaced the barrier for chroot security?

On Wed, 14 Dec 2011 02:37:36 +0100
Herbert Poetzl <herbert@13thfloor.at> wrote:

> On Tue, Dec 13, 2011 at 11:18:38AM -0700, Dan Urist wrote:
> > I have a number of vservers running on a Debian lenny host that
> > I'm planning to migrate to a squeeze host. The vservers' root
> > filesystems are on NFS shares from a netapp.
>
> > I've followed the instructions to set the barrier attribute here:
> > http://linux-vserver.org/Secure_chroot_Barrier#Solution:_Secure_Barrier
>
> > The problem I'm having is "setattr --barrier" doesn't appear to
> > do anything for the NFS filesystems, as reported by showattr
> > (it works for other vservers on ext3 filesystems, though).
> > I've tried this on both the lenny and the squeeze hosts, with
> > the filesystems mounted as both NFSv3 and NFSv4 (the netapp
> > supports both). I've also tried mounting the filesystems with
> > the "noac" option, which had no effect. Here are the package
> > versions for the squeeze host:
>
> > linux-image-2.6.32-5-vserver-amd64
> > 2.6.32-39 util-vserver
> > 0.30.216-pre2864-2+b1
>
> the barrier is not implemented for NFS as NFS doesn't
> support xattr (which the barrier is based on) at all
>
> but, with a recent kernel and recent util-vserver,
> you won't be needing the barrier anyway ...
>
> note that I do not know if the debian kernel/tools
> are recent enough, so I'd suggest to ask the debian
> folks about this case.
>
> HTH,
> Herbert
>
> > Does anyone have any experience with running vservers over NFS?
>
>
> > --
> > Dan Urist
> > durist@ucar.edu
> > 303-497-2459

-- 
Dan Urist
durist@ucar.edu
303-497-2459
Received on Wed Dec 14 16:14:40 2011
[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Wed 14 Dec 2011 - 16:14:41 GMT by hypermail 2.1.8