Subject: Re: [vserver] setattr for vserver over NFS
From: Herbert Poetzl <herbert@13thfloor.at>
Date: Wed, 14 Dec 2011 19:16:58 +0100

On Wed, Dec 14, 2011 at 09:14:24AM -0700, Dan Urist wrote:
> Can you tell me (or give me a pointer to some docs) what
> mechanism has replaced the barrier for chroot security?

mount/filesystem namespaces and pivot basically makes
the barrier obsolete, as it shouldn't be possible to
escape from a separate namespace.

best,
Herbert

> On Wed, 14 Dec 2011 02:37:36 +0100
> Herbert Poetzl <herbert@13thfloor.at> wrote:

>> On Tue, Dec 13, 2011 at 11:18:38AM -0700, Dan Urist wrote:
>>> I have a number of vservers running on a Debian lenny host that
>>> I'm planning to migrate to a squeeze host. The vservers' root
>>> filesystems are on NFS shares from a netapp.

>>> I've followed the instructions to set the barrier attribute here:
>>> http://linux-vserver.org/Secure_chroot_Barrier#Solution:_Secure_Barrier

>>> The problem I'm having is "setattr --barrier" doesn't appear to
>>> do anything for the NFS filesystems, as reported by showattr
>>> (it works for other vservers on ext3 filesystems, though).
>>> I've tried this on both the lenny and the squeeze hosts, with
>>> the filesystems mounted as both NFSv3 and NFSv4 (the netapp
>>> supports both). I've also tried mounting the filesystems with
>>> the "noac" option, which had no effect. Here are the package
>>> versions for the squeeze host:

>>> linux-image-2.6.32-5-vserver-amd64
>>> 2.6.32-39 util-vserver
>>> 0.30.216-pre2864-2+b1 

>> the barrier is not implemented for NFS as NFS doesn't
>> support xattr (which the barrier is based on) at all

>> but, with a recent kernel and recent util-vserver,
>> you won't be needing the barrier anyway ...

>> note that I do not know if the debian kernel/tools
>> are recent enough, so I'd suggest to ask the debian
>> folks about this case.

>> HTH,
>> Herbert

>>> Does anyone have any experience with running vservers over NFS?


>>> -- 
>>> Dan Urist
>>> durist@ucar.edu
>>> 303-497-2459



> -- 
> Dan Urist
> durist@ucar.edu
> 303-497-2459