Fri, 20 Jun 2008 10:23:22 -0400 Daniel/Others... Any thoughts? http://users.k12system.com/mrwizard/software/patch-vserver-cap bound set.diff Joe > -----Original Message----- > From: Joe Gooch [mailto:mrwizard@k12system.com] > Sent: Monday, June 16, 2008 10:14 PM > To: Daniel Hokka Zakrisson > Cc: vserver@list.linux-vserver.org > Subject: Re: [vserver] Capabilities in Vserver Kernels > > Your patch: allows guests to change /proc/sys/kernel/cap-bound. > My patch: prevents chcontext from intersecting I, E, and P > with cap-bound. (instead, it uses bcapabilities) > > I don't change the meanings of any variables. > > > Here's an example of the breakage. > > > Context 0: > > $ sudo cat /proc/sys/kernel/cap-bound > 128 > > $ /usr/sbin/getpcaps = > Capabilities for `=': =i cap setpcap-i > > $ cat /proc/self/status |grep Cap > CapInh: 00000000fffffeff > CapPrm: 0000000000000000 > CapEff: 0000000000000000 > > $ sudo cat /proc/self/status |grep Cap > CapInh: 00000000fffffeff > CapPrm: 00000000fffffeff > CapEff: 00000000fffffeff > > $ /usr/sbin/execcap " = cap setuid,cap setgid+i " /usr/sbin/getpcaps = Capabilities for `=': = > cap setgid,cap setuid+i > > $ /usr/sbin/execcap " = cap setuid,cap setgid+i " cat > /proc/self/status > |grep Cap > CapInh: 00000000000000c0 > CapPrm: 0000000000000000 > CapEff: 0000000000000000 > > $ /usr/sbin/execcap " = cap setuid,cap setgid+i " sudo > /usr/sbin/getpcaps = Capabilities for `=': = cap setgid,cap setuid+eip > > $ /usr/sbin/execcap " = cap setuid,cap setgid+i " sudo cat > /proc/self/status |grep Cap > CapInh: 00000000000000c0 > CapPrm: 00000000000000c0 > CapEff: 00000000000000c0 > > > > > Starting a vserver: > # vserver test start > > vnamespace: vc set namespace(): Function not implemented > > An error occured while executing the vserver startup > sequence; when there are no other messages, it is very likely > that the init-script (/etc/rc.d/rc 3) failed. > > Common causes are: > * /etc/rc.d/rc on Fedora Core 1 and RH9 fails always; the > 'apt-rpm' build > method knows how to deal with this, but on existing installations, > appending 'true' to this file will help. > > > Failed to start vserver 'test' > > Want to know why? It's because my cap-bound excludes > CAP CONTEXT, and the chcontext() call is intersecting with > cap-bound. Thus, the vserver process is left with setuid > only. (cap-bound is 128) > > Filtering on bcapabilities instead makes things work right. > > Do you have another solution? > > Joe >