On 06/10/2009, at 07.45, Wilhelm Meier wrote: > Hi again, > > Herbert Poetzl schrieb: >> On Mon, Oct 05, 2009 at 07:46:23PM +0200, Wilhelm Meier wrote: >>> we use a vserver as terminal-server, quite a normal setup, i think. >>> The host and guest are both debian lenny. >>> For some reason we need a polyinstantiated /media directory. i >>> would like to do this with pam_namespace. >> hmm .. could you elaborate on that? >> sounds to me like you want to mount something there? > > we use our own netbootet thin-clients (and so called rich-clients). > The thin-clients can export their local devices (if plugged) via an > fuse-based filesystem called mediafs. On the terminal-server > (vserver) a mount is triggered. Up to now the fuse-mount happened in > $HOME/remote. This is suboptimal for our unskilled users, since they > are used to have the devices under /media (for the rich-clients or > locally installed machines). > So we came across the idea to have a session-namespace per login > into the terminalserver and use then private mounts on /media, so > every user only sees his/her thin-client devices. > >>> When I use pam_namespace in the pamm-session-stack I get the >>> following error: >>> Oct 5 19:28:23 192.168.222.12 kdm: >>> rich00E0C5600493.intern.kmux.de:1[27525]: >>> pam_namespace(kdm:session): Unable to unshare from parent >>> namespace, Operation not permitted >> assuming that the pam module does an unshare with >> CLONE_NEWNS, you can permit that with the context >> capability VXC_NAMESPACE > > hmm, the util-vserver from lenny don't support this. I looked into > the sources (via the link from the great flowers page) and they lack > of this capability setting (the kernel code contains this flag). lenny is not so updated on vserver. Compile your own. JonB