Subject: which capability for TUNSETIFF?
From: "Gregory (Grisha) Trubetskoy" <grisha@apache.org>
Date: Wed, 29 Jul 2009 12:22:26 -0400 (EDT)


I hope I am not missing something obvious, but I do not seem to be able to 
figure which capability I need to allow TUNSETIFF.

I am trying to start QEMU with the -net tap option in a vserver context.

I tried all sorts of things, e.g.:

# vcontext --create --xid=10 -- vattribute --bcap NET_ADMIN --bcap SYS_ADMIN -- 
chbind --nid 10 --ncap TUN_CREATE -- bash

(then from bash i'd start qemu).

strace shows that it is failing at:

open("/dev/net/tun", O_RDWR)            = 5
ioctl(5, TUNSETIFF, 0x7fff5c9cf700)     = -1 EPERM (Operation not permitted)
write(2, "warning: could not configure /de"..., 72) = 72
close(5)                                = 0
write(2, "Could not initialize device \'tap"..., 34) = 34
exit_group(1)                           = ?



# vserver-info
Versions:
                    Kernel: 2.6.30.1-vs2.3.0.36.14-pre4
                    VS-API: 0x00020304
              util-vserver: 0.30.216-pre2841; Jul 29 2009, 09:02:19