dash700@excite.com wrote: > Hello VServer experts! > > I'm working on a project that uses VServer to provide application > isolation functionality. As part of the development we came across a > problem supporting multicast binding from inside vserver unless NET_ADMIN > capability is turned on. It appears that VServer treats multicast > addresses as any other network address. So in order to allow multicast > addresses in vserver they need to be a part of NX_INFO list. This list can > become quite large if all multicast address space is included. If you use Linux-VServer 2.3, you could just do naddress --nid <guest> --add --mask 224.0.0.0/4. I don't see how CAP_NET_ADMIN would let you get around the address restrictions though. > I've looked at af_inet.c code and it appears that it's easy to provide > multicast support if multicast addresses are differentiated from the rest > of the address space. I believe this is safe to do because multicast > addresses are handled differently by the kernel than normal IP addresses. > I've attached a patch against a stable VServer release and 2.6.22 kernel > that provides multicast support to vservers without NET_ADMIN capability. > > Would it be possible to review this patch for any criticism and possibly > inclusion into upcoming stable VServer release if it is useful? > > multicast-plain.diff : Kernel patch This would need a network context capability, at least. > demo_mc_bind.c : C program that demonstrates lack of multicast support > inside VServer > > Thank you in advance! > > Sincerely, > Artem Dmytrenko -- Daniel Hokka Zakrisson