Subject: Re: [vserver] vxW: did lookup hidden devpts
From: Sebastien Bonnegent <sebastien.bonnegent@insa-rouen.fr>
Date: Thu, 02 Apr 2009 17:13:34 +0200
Thu, 02 Apr 2009 17:13:34 +0200

Ok, thank you for all this information :)


Herbert Poetzl a écrit :
> On Fri, Mar 27, 2009 at 10:57:07AM +0100, Sebastien Bonnegent wrote:
> Herbert Poetzl a écrit :
>>>> On Thu, Mar 26, 2009 at 02:36:09PM +0100, Sebastien Bonnegent wrote:
>>>> This lines is generated by the command "vps ax" on master. 
>>>>
>>>>> usually those lines are generated by pts/ptys which
>>>>> were 'brought' into a context via 'enter' or 'exec'
>>>>> if you get those messages without entering a guest,
>>>>> I'm quite interested in a reproduceable setup.
> I do only a "vps ax" on the master, so without 'exec' or 'enter'. If I enable
> "CONFIG VSERVER PRIVACY", this command always generate lines below:
> [ 3062.859858] vxW: [»ps«,22083:#1|0|0] did lookup hidden devpts:f5689a40[#0,2] »/dev/pts«.
> [ 3363.185658] vxW: [»ps«,22348:#1|0|0] did lookup hidden devpts:f5689a40[#0,2] »/dev/pts«.
> [ 3662.571683] vxW: [»ps«,22627:#1|0|0] did lookup hidden devpts:f5689a40[#0,2] »/dev/pts«.
> [ 3962.682085] vxW: [»ps«,3483:#1|0|0] did lookup hidden devpts:f5689a40[#0,2] »/dev/pts«.
> [ 4262.661764] vxW: [»ps«,3747:#1|0|0] did lookup hidden devpts:f5689a40[#0,2] »/dev/pts«.
> 
> With "CONFIG VSERVER PRIVACY" disable, I have no log.
> 
>> that is expected too, if you want to honor the guests
>> privacy, the ptys are naturally off limits ...
> 
>>>> Can I find somewhere the description of 
>>>>
>>>>> yes, the kernel config contains descriptions for all
>>>>> the config options, just press '?' to view them
> Yes, but descriptions are a bit short :)
> 
>> patches are welcome :)
> 
>>>> "CONFIG VSERVER PRIVACY" option ?
>>>>
>>>>>           When enabled, most context checks will disallow
>>>>>           access to structures assigned to a specific context,
>>>>>           like ptys or loop devices.
> Thank you.
> With this option master can't access structures of a context, or it
> concern only guests to guests ?
> 
>> host - guest, guest - guest is protected by default
>> thus it is called isolation :)
> 



-- 
Cordialement - Sébastien Bonnegent

                  "GNU/Linux, il y a moins bien mais c'est plus cher."
---------------------------------------------------------------------------------------
| http://www.insa-rouen.fr/institution/organisation/equipe-de-direction/informatique/
|
---------------------------------------------------------------------------------------
       | Ingénieur système et réseau | Tél: 02 32 95 98 61 | GnuPG: 0x669176B0 |
       -------------------------------------------------------------------------
                 | https://asi.insa-rouen.fr/asipedia/index.php/GnuPG |
                 ------------------------------------------------------



["application/pgp-signature" not shown]