Subject: Re: [vserver] Copy-on-write Hard Links, Shared Libraries, Prelink and Memory
From: Herbert Poetzl <herbert@13thfloor.at>
Date: Thu, 10 Jun 2010 21:50:38 +0200

On Thu, Jun 10, 2010 at 10:13:06AM +0100, Gordan Bobic wrote:
> On 06/10/2010 01:46 AM, Herbert Poetzl wrote:
> >On Wed, Jun 09, 2010 at 01:24:42PM +0100, Gordan Bobic wrote:
> >>On 06/09/2010 08:48 AM, Corey Wright wrote:
> >>>On Tue, 08 Jun 2010 23:39:51 +0100
> >>>Gordan Bobic<gordan@bobich.net>   wrote:

> >>>>Finally, is there a utility for re-merging files that got unmerged,
> >>>>if they get replaced with the old version that is again the same
> >>>>as the template? Can somebody point me at the relevant bit of
> >>>>documentation on this?

> >>># hashify a vserver
> >>>vserver ${VSERVER_NAME} hashify

> >>Is there a way to include the host into the hashification? If I'm
> >>running, say, RHEL5 on RHEL5, it seems wasteful to not merge host's
> >>files in as well. Obviously, I could do it manually - I'm more
> >>concerned whether it would break something I can't think of at the
> >>moment.

> >it is not a good idea to do that for several reasons, one
> >being the fact that host files are used from the host
> >context and so the tools working on them could accidentially
> >overwrite shared guest files or set permissions which are
> >not desired inside the guest ....

> What is there to prevent the same thing happening between guests? 

context isolation

> My understanding is that the guest contexts are as individually 
> separate and distinct from each other as they are from the host. 

that is a misconception, the host (context 0) is only
separated from each guest by a few system calls and 
usually has full access to the guest filesystem

> Is that not the case? 

nope

> Is there a security implication here?

yep

> Essentially - if it is not safe to do this between the host and 
> a guest, how come it is safe to do between guests?

because the host (context) has all priviledges and
can manipulate all the guests (and usually their filesystem
without any restriction)

so, the danger is not that the guest will modify a host
binary and use that for some kind of exploit, the danger
is more that you accidentially drop the required security
mechanisms while accessing those files (from the host)
and the guest could exploit this to mess with the host
binaries ... or it could simply mess up the guest by
involuntarily changing guest files (along with host changes)

the guests are all limited in their capabilities and will
not be able to do such things, but the host context is not
limited at all, i.e. everything goes :)

besides that, having a few hundred megabytes of host
files/binaries are usually acceptable ...

HTC,
Herbert

> Gordan