Subject: Re: [vserver] I'd like to --move it --move it
From: Herbert Poetzl <herbert@13thfloor.at>
Date: Mon, 13 Dec 2010 21:13:27 +0100

On Mon, Dec 13, 2010 at 09:07:39AM +0000, Ben Green wrote:
> Quoting "Jon Bendtsen" <jbendtsen@laerdal.dk>:

>>> Is there some kind of flag I can set to make this work? 
>>> What else  
>>> should I try?

>> danger! alert! security risk!

>> If you give your guest the mount capability then I am 
>> sure it can do what you want to do.

> Don't be so sure! 
> The server has long time had a number of insecure  
> settings crucial for LTSP operation, ccaps:

> BINARY_MOUNT
> SECURE_MOUNT
> SECURE_REMOUNT
> SET_UTSNAME
> RAW_ICMP
> SYSLOG
> NAMESPACE
> FS_SECURITY

none of the above are insecure per se ...

> And bcaps:

> NET_RAW
> MKNOD

those are insecure and basically render your
system open to all kinds of evil attacks from
inside the guest ....

> I think MKNOD is removable now, but was need for 
> building the LTSP chroot.

I doubt that ...

anyway, a quick look at the code shows that
this is not a capability problem ...

I presume your mount syscall returns with
EINVAL not with EPERM (strace will show) and
that can be caused by a bunch of things

my bet would be that it is caused by the
shared namespace/mount propagation configure
by util-vserver to allow to administrate the
guest from outside ...

HTH,
Herbert

> Cheers,
> ==
> From Ben Green