Jon Bendtsen schrieb: > On 06/10/2009, at 07.45, Wilhelm Meier wrote: > >> Hi again, >> >> Herbert Poetzl schrieb: >>> On Mon, Oct 05, 2009 at 07:46:23PM +0200, Wilhelm Meier wrote: >>>> we use a vserver as terminal-server, quite a normal setup, i think. >>>> The host and guest are both debian lenny. >>>> For some reason we need a polyinstantiated /media directory. i would >>>> like to do this with pam_namespace. >>> hmm .. could you elaborate on that? >>> sounds to me like you want to mount something there? >> >> we use our own netbootet thin-clients (and so called rich-clients). >> The thin-clients can export their local devices (if plugged) via an >> fuse-based filesystem called mediafs. On the terminal-server (vserver) >> a mount is triggered. Up to now the fuse-mount happened in >> $HOME/remote. This is suboptimal for our unskilled users, since they >> are used to have the devices under /media (for the rich-clients or >> locally installed machines). >> So we came across the idea to have a session-namespace per login into >> the terminalserver and use then private mounts on /media, so every >> user only sees his/her thin-client devices. >> >>>> When I use pam_namespace in the pamm-session-stack I get the >>>> following error: >>>> Oct 5 19:28:23 192.168.222.12 kdm: >>>> rich00E0C5600493.intern.kmux.de:1[27525]: >>>> pam_namespace(kdm:session): Unable to unshare from parent namespace, >>>> Operation not permitted >>> assuming that the pam module does an unshare with >>> CLONE_NEWNS, you can permit that with the context >>> capability VXC_NAMESPACE >> >> hmm, the util-vserver from lenny don't support this. I looked into the >> sources (via the link from the great flowers page) and they lack of >> this capability setting (the kernel code contains this flag). > > lenny is not so updated on vserver. Compile your own. Yes: also squeeze is too old ... now it works ;-) There is one thing that is different to a plain host: pam_namespace use the wrong mode/user for the polyinstantiated directory ... strange. -- Wilhelm