Ed W wrote: > Daniel Hokka Zakrisson wrote: >> Alejandro Cabrera wrote: >> >>> <snip previous messages due to formatting> >>> Just CAP_NET_RAW capability ??? Or in group with CAP_NET_ADMIN >>> capability >>> ??? >>> >> >> CAP_NET_RAW is what governs raw sockets. If you give a guest that, it >> will >> be able to able sniff/generate traffic as it sees fit. >> > > So to be clear - this is *off* by default right? Yes, of course. > How do I check the caps that a running instance actually *has*? cat /proc/virtual/<xid>/status http://linux-vserver.org/Capabilities_and_Flags With util-vserver 0.30.215+, vattribute --get --xid <guest> and nattribute --get --nid <guest> are supposed to do that for you. >> CAP_NET_ADMIN "only" lets the guest do network setup, such as >> configuring >> interfaces, routes, etc. > > But couldn't this be used to bring up an interface with the same IP (or > at least netmask) as a running vserver? That interface would already be up. It doesn't allow the guest to modify the list of addresses assigned to the context, so if it doesn't _also_ have CAP_NET_RAW, bringing up another interface wouldn't change anything. > Eg consider using 127.0.x/24 > netmasks for each verser, couldn't rogue vserver 2 with tap into > 127.0.1.y which we meant to assign only for use with vserver 1? This > would at least allow them to talk to (eg) the mysql instance that we > were running on 127.0.1.1/24 with an expectation of it being private to > that vhost? That would already be possible, unless you have iptables rules forbidding that traffic... (Except on Linux-VServer 2.3, where 127.0.0.0/8 is rewritten to the lback IP address.) > Just checking? > > Ed W > > -- Daniel Hokka Zakrisson