Subject: Re: [vserver] Vserver and localhost sniffing
From: "Daniel Hokka Zakrisson" <daniel@hozac.com>
Date: Tue, 26 Feb 2008 13:20:16 +0100 (CET)

Alejandro Cabrera wrote:
> Dear all, I read that if I have a vserver host with lo (127.0.0.1) and
> some vserver guests with lo 127.0.0.2, 127.0.0.3, etc...there is a
>
> risk that some guest root can use some type of sniffer (cap) and sniff the
> traffic across 127.0.0.1 that is ALL localhost traffic (including
> 127.0.0.2, 127.0.0.3, etc.). This is a serious security problem.
>
>
>
> Here is my question: what happen with localhost sniffing if I assign a
> private IP to the guest localhosts in order to replace 127.0.0.2,
>
> 127.0.0.3, etc. with 192.168.0.2, 192.168.0.3, etc.??? Guest roots can
> still sniff the traffic ???

root in a guest simply cannot sniff traffic at all, if you don't give
him/her too many capabilities. If you give the guest CAP_NET_RAW, root
will be able to see _any_ traffic on _any_ interface, regardless of
restrictions placed on the network context.

-- 
Daniel Hokka Zakrisson