About this list Date view Thread view Subject view Author view Attachment view

From: Adam H. Pendleton (fmonkey_at_fmonkey.net)
Date: Mon 16 Dec 2002 - 19:36:49 GMT


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Mime-Version: 1.0
Content-Type: multipart/alternative;
        boundary="=====================_7495546==.ALT"

- --=====================_7495546==.ALT
Content-Type: text/plain; charset="us-ascii"; format=flowed

This is a RedHat 7.3 box, using the most recent RedHat kernel,
2.4.18-18.7.x, modified with the vserver patches from the "~shadow" link in
the FAQ.

ahp

At 12:35 12/16/2002, you wrote:
>Adam, which version of the kernel are you using? This is a big deal if a
>user in the vserver can knock the whole box offline... especially for
>those of us with less-trusted users playing with root in the vserver.
>
>THanks!
>
>On Mon, 16 Dec 2002, Adam H. Pendleton wrote:
>
> > At 10:44 12/16/2002, you wrote:
> > >On Mon, 16 Dec 2002, Adam H. Pendleton wrote:
> > > > The `vserver <name> build` operation worked great, with one problem
> [..]
> > > >
> > > > A `vserver <name> stop` operation runs [..] `/etc/init.d/network stop`,
> > > > which kills all network connectivity to the box!!
> > >
> > >This should fail in a vserver (or have you given the vserver more
> > >capabilites like CAP_NET_ADMIN to allow it access to the kernel
> > >networking interfaces that are otherwise denied)?
> >
> > No additional capabilities were given to the vserver, at least not by my
> > hand. :) The /etc/init.d/network script calls /sbin/ifdown to stop
> > interfaces. The interface is passed the name of the device (e.g. eth0),
> > not an IP, so when executing `vserver <name> stop` the RedHat init
> lines go
> > by, until I see
> >
> > blah blah blah [OK]
> > Stopping interface eth0...
> >
> > and then it's off-line.
> >
> >
> > > > I assume the only way to prevent this is to delete/modify /etc/init.d/
> > >
> > >Best to delete them (or rather the runlevel sysvinit symlinks to them).
> > >My Debian install script currently does `update-rc.d foo remove' on:
> > >
> > > klogd hwclock.sh setserial urandom networking umountfs halt reboot
> > >
> > >(Anything related to hardware or kernel management which is going to fail
> > >anyway just sitting there and timing out).
> >
> > I will be sure to delete them, but not because they're timing out. :)
> >
> >
> > > -Paul
> > >--
> > >Nottingham, GB
> >

- --=====================_7495546==.ALT
Content-Type: text/html; charset="us-ascii"

<html>
<body>
<font size=3>This is a RedHat 7.3 box, using the most recent RedHat
kernel, 2.4.18-18.7.x, modified with the vserver patches from the
&quot;~shadow&quot; link in the FAQ.<br><br>
ahp<br><br>
At 12:35 12/16/2002, you wrote:<br>
<blockquote type=cite class=cite cite>Adam, which version of the kernel
are you using?&nbsp; This is a big deal if a <br>
user in the vserver can knock the whole box offline... especially for
<br>
those of us with less-trusted users playing with root in the
vserver.<br><br>
THanks!<br><br>
On Mon, 16 Dec 2002, Adam H. Pendleton wrote:<br><br>
&gt; At 10:44 12/16/2002, you wrote:<br>
&gt; &gt;On Mon, 16 Dec 2002, Adam H. Pendleton wrote:<br>
&gt; &gt; &gt; The `vserver &lt;name&gt; build` operation worked great,
with one problem [..]<br>
&gt; &gt; &gt;<br>
&gt; &gt; &gt; A `vserver &lt;name&gt; stop` operation runs [..]
`/etc/init.d/network stop`,<br>
&gt; &gt; &gt; which kills all network connectivity to the box!!<br>
&gt; &gt;<br>
&gt; &gt;This should fail in a vserver (or have you given the vserver
more<br>
&gt; &gt;capabilites like CAP_NET_ADMIN to allow it access to the
kernel<br>
&gt; &gt;networking interfaces that are otherwise denied)?<br>
&gt; <br>
&gt; No additional capabilities were given to the vserver, at least not
by my <br>
&gt; hand.&nbsp; :)&nbsp; The /etc/init.d/network script calls
/sbin/ifdown to stop <br>
&gt; interfaces.&nbsp; The interface is passed the name of the device
(e.g. eth0), <br>
&gt; not an IP, so when executing `vserver &lt;name&gt; stop` the RedHat
init lines go <br>
&gt; by, until I see<br>
&gt; <br>
&gt; blah blah
blah&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
[OK]<br>
&gt; Stopping interface eth0...<br>
&gt; <br>
&gt; and then it's off-line.<br>
&gt; <br>
&gt; <br>
&gt; &gt; &gt; I assume the only way to prevent this is to delete/modify
/etc/init.d/<br>
&gt; &gt;<br>
&gt; &gt;Best to delete them (or rather the runlevel sysvinit symlinks to
them).<br>
&gt; &gt;My Debian install script currently does `update-rc.d foo remove'
on:<br>
&gt; &gt;<br>
&gt; &gt;&nbsp;&nbsp; klogd hwclock.sh setserial urandom networking
umountfs halt reboot<br>
&gt; &gt;<br>
&gt; &gt;(Anything related to hardware or kernel management which is
going to fail<br>
&gt; &gt;anyway just sitting there and timing out).<br>
&gt; <br>
&gt; I will be sure to delete them, but not because they're timing
out.&nbsp; :)<br>
&gt; <br>
&gt; <br>
&gt; &gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -Paul<br>
&gt; &gt;--<br>
&gt; &gt;Nottingham, GB<br>
&gt; </font></blockquote></body>
</html>

- --=====================_7495546==.ALT--

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0

iQA/AwUBPf4rWd0rskLi2W+SEQKvegCgq9GjWSE5CYmGrnqBnaIkUU+JZmEAn14K
wPEueRX/72rsMtcBl79qOPn4
=6o3t
-----END PGP SIGNATURE-----


About this list Date view Thread view Subject view Author view Attachment view
[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Mon 16 Dec 2002 - 19:59:45 GMT by hypermail 2.1.3