Can you tell me (or give me a pointer to some docs) what mechanism has replaced the barrier for chroot security? On Wed, 14 Dec 2011 02:37:36 +0100 Herbert Poetzl <herbert@13thfloor.at> wrote: > On Tue, Dec 13, 2011 at 11:18:38AM -0700, Dan Urist wrote: > > I have a number of vservers running on a Debian lenny host that > > I'm planning to migrate to a squeeze host. The vservers' root > > filesystems are on NFS shares from a netapp. > > > I've followed the instructions to set the barrier attribute here: > > http://linux-vserver.org/Secure_chroot_Barrier#Solution:_Secure_Barrier > > > The problem I'm having is "setattr --barrier" doesn't appear to > > do anything for the NFS filesystems, as reported by showattr > > (it works for other vservers on ext3 filesystems, though). > > I've tried this on both the lenny and the squeeze hosts, with > > the filesystems mounted as both NFSv3 and NFSv4 (the netapp > > supports both). I've also tried mounting the filesystems with > > the "noac" option, which had no effect. Here are the package > > versions for the squeeze host: > > > linux-image-2.6.32-5-vserver-amd64 > > 2.6.32-39 util-vserver > > 0.30.216-pre2864-2+b1 > > the barrier is not implemented for NFS as NFS doesn't > support xattr (which the barrier is based on) at all > > but, with a recent kernel and recent util-vserver, > you won't be needing the barrier anyway ... > > note that I do not know if the debian kernel/tools > are recent enough, so I'd suggest to ask the debian > folks about this case. > > HTH, > Herbert > > > Does anyone have any experience with running vservers over NFS? > > > > -- > > Dan Urist > > durist@ucar.edu > > 303-497-2459 -- Dan Urist durist@ucar.edu 303-497-2459