Subject: Re: [vserver] vxW: did lookup hidden devpts
From: Herbert Poetzl <herbert@13thfloor.at>
Date: Thu, 2 Apr 2009 12:48:18 +0200

On Fri, Mar 27, 2009 at 10:57:07AM +0100, Sebastien Bonnegent wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Herbert Poetzl a écrit :
> > On Thu, Mar 26, 2009 at 02:36:09PM +0100, Sebastien Bonnegent wrote:
> > This lines is generated by the command "vps ax" on master. 
> > 
> >> usually those lines are generated by pts/ptys which
> >> were 'brought' into a context via 'enter' or 'exec'
> >> if you get those messages without entering a guest,
> >> I'm quite interested in a reproduceable setup.
> 
> I do only a "vps ax" on the master, so without 'exec' or 'enter'. If I enable
> "CONFIG_VSERVER_PRIVACY", this command always generate lines below:
> [ 3062.859858] vxW: [»ps«,22083:#1|0|0] did lookup hidden devpts:f5689a40[#0,2] »/dev/pts«.
> [ 3363.185658] vxW: [»ps«,22348:#1|0|0] did lookup hidden devpts:f5689a40[#0,2] »/dev/pts«.
> [ 3662.571683] vxW: [»ps«,22627:#1|0|0] did lookup hidden devpts:f5689a40[#0,2] »/dev/pts«.
> [ 3962.682085] vxW: [»ps«,3483:#1|0|0] did lookup hidden devpts:f5689a40[#0,2] »/dev/pts«.
> [ 4262.661764] vxW: [»ps«,3747:#1|0|0] did lookup hidden devpts:f5689a40[#0,2] »/dev/pts«.
> 
> With "CONFIG_VSERVER_PRIVACY" disable, I have no log.

that is expected too, if you want to honor the guests
privacy, the ptys are naturally off limits ...

> > Can I find somewhere the description of 
> > 
> >> yes, the kernel config contains descriptions for all
> >> the config options, just press '?' to view them
> 
> Yes, but descriptions are a bit short :)

patches are welcome :)

> > "CONFIG_VSERVER_PRIVACY" option ?
> > 
> >>           When enabled, most context checks will disallow
> >>           access to structures assigned to a specific context,
> >>           like ptys or loop devices.
> > 
> 
> Thank you.
> With this option master can't access structures of a context, or it
> concern only guests to guests ?

host - guest, guest - guest is protected by default
thus it is called isolation :)

HTC,
Herbert

> > Sebastien Bonnegent wrote:
> >>>> Hi,
> >>>>
> >>>> I have this lines in my syslog:
> >>>>
> >>>> [ 3872.477649] vxW: [???ps???,23026:#1|0|0] did lookup hidden devpts:f55dd500[#0,2]
???/dev/pts???.
> >>>> [ 4172.175854] vxW: [???ps???,23291:#1|0|0] did lookup hidden devpts:f55dd500[#0,2]
???/dev/pts???.
> >>>> [ 4472.844371] vxW: [???ps???,23570:#1|0|0] did lookup hidden devpts:f55dd500[#0,2]
???/dev/pts???.
> >>>>
> >>>> Do you know what is it ?
> >>>>
> >>>> # uname -r
> >>>> 2.6.28.7-vs2.3.0.36.8-090326
> >>>>
> >>>> # grep VSERVER /boot/config-2.6.28.7-vs2.3.0.36.8-090326
> >>>> CONFIG_VSERVER_AUTO_LBACK=y
> >>>> CONFIG_VSERVER_AUTO_SINGLE=y
> >>>> CONFIG_VSERVER_COWBL=y
> >>>> # CONFIG_VSERVER_VTIME is not set
> >>>> # CONFIG_VSERVER_DEVICE is not set
> >>>> CONFIG_VSERVER_PROC_SECURE=y
> >>>> CONFIG_VSERVER_HARDCPU=y
> >>>> CONFIG_VSERVER_IDLETIME=y
> >>>> # CONFIG_VSERVER_IDLELIMIT is not set
> >>>> CONFIG_VSERVER_PRIVACY=y
> >>>> CONFIG_VSERVER_CONTEXTS=256
> >>>> CONFIG_VSERVER_WARN=y
> >>>> # CONFIG_VSERVER_DEBUG is not set
> >>>> CONFIG_VSERVER=y
> >>>> CONFIG_VSERVER_SECURITY=y
> >>>>
> >>>>
> 
> - --
> Cordialement - Sébastien Bonnegent
> 
>                   "GNU/Linux, il y a moins bien mais c'est plus cher."
> - ---------------------------------------------------------------------------------------
> | http://www.insa-rouen.fr/institution/organisation/equipe-de-direction/informatique/
|
> - ---------------------------------------------------------------------------------------
>        | Ingénieur système et réseau | Tél: 02 32 95 98 61 | GnuPG: 0x669176B0 |
>        -------------------------------------------------------------------------
>                  | https://asi.insa-rouen.fr/asipedia/index.php/GnuPG |
>                  ------------------------------------------------------
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.9 (GNU/Linux)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
> 
> iEYEARECAAYFAknMouwACgkQlMHL02aRdrBHXwCdGc/7l21rjCRnMqrBvHmVgup0
> B1EAn2EeXhgkwC89n3tbrsDh4pl/YFs6
> =NgAa
> -----END PGP SIGNATURE-----