Subject: Re: [vserver] mknod inside vserver (bind error)
From: Herbert Poetzl <herbert@13thfloor.at>
Date: Fri, 8 May 2009 22:35:42 +0200

On Thu, May 07, 2009 at 08:33:31PM +0200, Jarry wrote:
> Herbert Poetzl wrote:
> 
> >>mknod: `/chroot/dns/dev/zero': Operation not permitted
> >>mknod: `/chroot/dns/dev/urandom': Operation not permitted
> >>Is there any fix, or workaround?

> >many, the simplest and still secure approach is
> >to create the necessary devices from the host
> >(either via mknod or simply by copying them into the quest)

> It doesn't work: if bind installation script finds "/chroot/dns"
> it says chrooting has been aready done and refuses to do it again

how's that related?

> >another approach is to setup device mapping
> >properly to allow certain 'considered secure'
> >devices to be created inside a guest

> I'm new to vserver, and its configurations is rather terrific
> to me but I tried it (though I'm not sure I did it properly):

> # mkdir -p /etc/vservers/vs4/apps/vdevmap/zero
> # mkdir -p /etc/vservers/vs4/apps/vdevmap/urandom
> # touch /etc/vservers/vs4/apps/vdevmap/zero/create
> # touch /etc/vservers/vs4/apps/vdevmap/urandom/create
> # touch /etc/vservers/vs4/apps/vdevmap/zero/open
> # touch /etc/vservers/vs4/apps/vdevmap/urandom/open
> # echo "MKNOD" > /etc/vservers/vs4/bcapabilities
> # vserver vs4 stop; vserver vs4 start

> Now I get past those errors just to get a new one:
> * Setting up the chroot directory...mount: permission denied

> Apparently, that script wants to mount something somewhere.
> How can I allow it in vserver-guest?

depends on the type of mount, but SECURE_MOUNT or
BINARY_MOUNT should do
(see http://linux-vserver.org/Capabilities_and_Flags)

HTH,
Herbert

> Jarry
> 
> -- 
> _______________________________________________________________
> This mailbox accepts e-mails only from selected mailing-lists!
> Everything else is considered to be spam and therefore deleted.