Subject: Re: [vserver] pam_namespace inside a vserver
From: Jon Bendtsen <jbendtsen@laerdal.dk>
Date: Tue, 6 Oct 2009 10:25:45 +0200

On 06/10/2009, at 07.45, Wilhelm Meier wrote:

> Hi again,
>
> Herbert Poetzl schrieb:
>> On Mon, Oct 05, 2009 at 07:46:23PM +0200, Wilhelm Meier wrote:
>>> we use a vserver as terminal-server, quite a normal setup, i think.
>>> The host and guest are both debian lenny.
>>> For some reason we need a polyinstantiated /media directory. i  
>>> would like to do this with pam_namespace.
>> hmm .. could you elaborate on that?
>> sounds to me like you want to mount something there?
>
> we use our own netbootet thin-clients (and so called rich-clients).  
> The thin-clients can export their local devices (if plugged) via an  
> fuse-based filesystem called mediafs. On the terminal-server  
> (vserver) a mount is triggered. Up to now the fuse-mount happened in  
> $HOME/remote. This is suboptimal for our unskilled users, since they  
> are used to have the devices under /media (for the rich-clients or  
> locally installed machines).
> So we came across the idea to have a session-namespace per login  
> into the terminalserver and use then private mounts on /media, so  
> every user only sees his/her thin-client devices.
>
>>> When I use pam_namespace in the pamm-session-stack I get the  
>>> following error:
>>> Oct  5 19:28:23 192.168.222.12 kdm:  
>>> rich00E0C5600493.intern.kmux.de:1[27525]:  
>>> pam_namespace(kdm:session): Unable to unshare from parent  
>>> namespace, Operation not permitted
>> assuming that the pam module does an unshare with
>> CLONE_NEWNS, you can permit that with the context
>> capability VXC_NAMESPACE
>
> hmm, the util-vserver from lenny don't support this. I looked into  
> the sources (via the link from the great flowers page) and they lack  
> of this capability setting (the kernel code contains this flag).

lenny is not so updated on vserver. Compile your own.




JonB