On Thu, May 07, 2009 at 08:33:31PM +0200, Jarry wrote: > Herbert Poetzl wrote: > > >>mknod: `/chroot/dns/dev/zero': Operation not permitted > >>mknod: `/chroot/dns/dev/urandom': Operation not permitted > >>Is there any fix, or workaround? > >many, the simplest and still secure approach is > >to create the necessary devices from the host > >(either via mknod or simply by copying them into the quest) > It doesn't work: if bind installation script finds "/chroot/dns" > it says chrooting has been aready done and refuses to do it again how's that related? > >another approach is to setup device mapping > >properly to allow certain 'considered secure' > >devices to be created inside a guest > I'm new to vserver, and its configurations is rather terrific > to me but I tried it (though I'm not sure I did it properly): > # mkdir -p /etc/vservers/vs4/apps/vdevmap/zero > # mkdir -p /etc/vservers/vs4/apps/vdevmap/urandom > # touch /etc/vservers/vs4/apps/vdevmap/zero/create > # touch /etc/vservers/vs4/apps/vdevmap/urandom/create > # touch /etc/vservers/vs4/apps/vdevmap/zero/open > # touch /etc/vservers/vs4/apps/vdevmap/urandom/open > # echo "MKNOD" > /etc/vservers/vs4/bcapabilities > # vserver vs4 stop; vserver vs4 start > Now I get past those errors just to get a new one: > * Setting up the chroot directory...mount: permission denied > Apparently, that script wants to mount something somewhere. > How can I allow it in vserver-guest? depends on the type of mount, but SECURE_MOUNT or BINARY_MOUNT should do (see http://linux-vserver.org/Capabilities_and_Flags) HTH, Herbert > Jarry > > -- > _______________________________________________________________ > This mailbox accepts e-mails only from selected mailing-lists! > Everything else is considered to be spam and therefore deleted.