Editing
Linux-VServer-Paper-14
(section)
From Linix VServer
Jump to navigation
Jump to search
Warning:
You are not logged in. Your IP address will be publicly visible if you make any edits. If you
log in
or
create an account
, your edits will be attributed to your username, along with other benefits.
Anti-spam check. Do
not
fill this in!
= 14. Step by Step Examples = The following examples can be reproduced on recent Linux systems without any modifications. <span id="e01-linux-caps-example"></span> == 14.0. [E01] <span id="E01"></span> Linux Caps Example == <pre> # grep Cap /proc/self/status CapInh: 0000000000000000 CapPrm: 00000000fffffeff CapEff: 00000000fffffeff</pre> <span id="e02-manipulating-linux-caps"></span> == 14.1. [E02] <span id="E02"></span> Manipulating Linux Caps == <pre> # lcap -z # grep Cap /proc/self/status CapInh: 0000000000000000 CapPrm: 0000000000000000 CapEff: 0000000000000000</pre> <span id="e03-cap_mknod-example"></span> == 14.2. [E03] <span id="E03"></span> CAP_MKNOD Example == <pre> # lcap -z CAP_MKNOD # mknod /tmp/null b 0 0 mknod: /tmp/null: Operation not permitted</pre> <span id="e11-resource-limits-via-bash"></span> == 14.3. [E11] <span id="E11"></span> Resource Limits via BASH == <pre> bash-2.05# ulimit -H -a core file size (blocks) unlimited data seg size (kbytes) unlimited file size (blocks) unlimited max locked memory (kbytes) unlimited max memory size (kbytes) unlimited open files 1024 pipe size (512 bytes) 8 stack size (kbytes) unlimited cpu time (seconds) unlimited max user processes 256 virtual memory (kbytes) unlimited</pre> <span id="e12-example-cpu-time-limit"></span> == 14.4. [E12] <span id="E12"></span> Example CPU Time Limit == <pre> bash-2.05# ulimit -t 10 bash-2.05# /tmp/cpuhog Killed</pre> <span id="e13-normal-file-without-attributes"></span> == 14.5. [E13] <span id="E13"></span> Normal File without Attributes == <pre> # touch /tmp/file # lsattr /tmp/file ------------- /tmp/file # rm -f /tmp/file</pre> <span id="e14-immutable-file-attribute"></span> == 14.6. [E14] <span id="E14"></span> Immutable File Attribute == <pre> # touch /tmp/file # chattr +i /tmp/file # lsattr /tmp/file ----i-------- /tmp/file # rm -f /tmp/file rm: unable to remove `/tmp/file': Operation not permitted # chattr -i /tmp/file # rm -f /tmp/file</pre> <span id="e15-chroot-example"></span> == 14.7. [E15] <span id="E15"></span> Chroot Example == <pre> # mkdir /tmp/root # mkdir /tmp/root/bin /tmp/root/lib # cp -a /lib/* /tmp/root/lib/ # cp -a /bin/bash /tmp/root/bin/ # cp -a /bin/ls /tmp/root/bin/ # chroot /tmp/root /bin/bash bash-2.05# ls / bin lib</pre> The now following examples require a Linux-VServer kernel and recent util-vserver tools. <span id="e21-process-isolation"></span> == 14.8. [E21] <span id="E21"></span> Process Isolation == <pre> # chcontext ps auxw New security context is 49152 USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 37 11.5 1.7 2408 500 tts/0 R 02:36 0:00 ps auxw</pre> <span id="e22-dual-context-isolation"></span> == 14.9. [E22] <span id="E22"></span> Dual Context Isolation == <pre> # chcontext --ctx 100 sleep 111 & # chcontext --ctx 200 sleep 222 & # chcontext --ctx 100 ps auxw New security context is 100 USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 23 0.3 1.5 2748 436 tts/0 S 18:47 0:00 sleep 111 root 26 28.0 2.2 2476 664 tts/0 R 18:48 0:00 ps auxw</pre> <span id="e23-fake-init-process"></span> == 14.10. [E23] <span id="E23"></span> Fake Init Process == <pre> # chcontext --flag fakeinit ps auxw New security context is 49153 USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 1 0.0 0.4 2756 552 ? S 19:09 0:04 init</pre> <span id="e24-network-isolation"></span> == 14.11. [E24] <span id="E24"></span> Network Isolation == <pre> # ifconfig lo 127.0.0.1 # ifconfig eth0 10.0.0.2 # ping -c 1 10.0.0.1 PING 10.0.0.1 (10.0.0.1) from 10.0.0.2 : 56(84) bytes of data. 64 bytes from 10.0.0.1: icmp_seq=0 ttl=64 time=4.814 msec # chbind --ip 127.0.0.1 ping -c 1 10.0.0.1 ipv4root is now 127.0.0.1 connect: Invalid argument</pre> <span id="e31-context-file-tagging"></span> == 14.12. [E31] <span id="E31"></span> Context File Tagging == <pre> # mount -o tagxid /dev/hd1/part1 /mnt/ # mkdir /mnt/test # touch /mnt/test/file # lsctx /mnt/test/file #0 /mnt/test/file # chcontext --ctx 100 touch /mnt/test/file_100 # lsctx -R /mnt/test #0 /mnt/test/file #100 /mnt/test/file_100</pre> <span id="e32-xid-file-permissions"></span> == 14.13. [E32] <span id="E32"></span> XID File Permissions == <pre> # mount -o tagxid /dev/hd1/part1 /mnt/ # chcontext --ctx 100 mkdir /mnt/100 New security context is 100 # chcontext --ctx 200 touch /mnt/100/file New security context is 200 touch: /mnt/100/file: Permission denied</pre> <span id="e33-context-flags"></span> == 14.14. [E33] <span id="E33"></span> Context Flags == <pre> # chcontext --flag ^24 cat /proc/mounts New security context is 49154</pre> <span id="e34-context-capabilities"></span> == 14.15. [E34] <span id="E34"></span> Context Capabilities == <pre> # chcontext --flag ^24 cat /proc/mounts New security context is 49154</pre> <span id="e41-context-accounting"></span> == 14.16. [E41] <span id="E41"></span> Context Accounting == <pre> # cat /proc/virtual/1001/cacct UNSPEC: 0/0 0/0 0/0 UNIX: 25/1626 25/1626 0/0 INET: 12/531 48/1653 55/1625 INET6: 0/0 0/0 0/0 OTHER: 0/0 0/0 0/0</pre> <span id="e42-context-limits"></span> == 14.17. [E42] <span id="E42"></span> Context Limits == <pre> # cat /proc/virtual/1001/limit PROC: 17 22 -1 0 VM: 14290 16502 17000 5 VML: 0 0 -1 0 RSS: 5455 7816 -1 0 FILES: 144 171 -1 0 OFD: -569 -541 -1 0</pre> <span id="e43-uptime-virtualization"></span> == 14.18. [E43] <span id="E43"></span> Uptime Virtualization == <pre> # uptime 20:31:11 up 21 min, load average: 0.20, 0.05, 0.01 # chcontext --ctx 100 --flag ^17 bash -c "sleep 100; uptime" New security context is 100 20:33:13 up 1 min, load average: 0.02, 0.03, 0.00</pre> <span id="e44-procfs-guest-security"></span> == 14.19. [E44] <span id="E44"></span> ProcFS Guest Security == <pre> # setattr --hide /proc/* # chcontext --ctx 100 ls /proc New security context is 100 527 self</pre> <span id="e45-procfs-host-security"></span> == 14.20. [E45] <span id="E45"></span> ProcFS Host Security == <pre> # setattr --hide --~admin /proc/* # ls /proc 1 10 12 13 16 2 3 4 5 532 6 7 8 9 self</pre> <span id="e46-token-cpu-allocation"></span> == 14.21. [E46] <span id="E46"></span> token CPU allocation == First, you need to set up two vservers with the =sched= flag set, on a current vs1.9 patched 2.6 kernel. This did work once on 2.4.24-ck1, and 2.4.*-ac, but such support is not currently maintained. This example assumes that two servers have been allocated equal CPU time (FIXME - how is this configured?) <pre> # vserver server1 enter server1# cpuhog& cpuhog& cpuhog& exit& # vserver server2 enter server2# cpuhog& exit # vtop</pre> In =vtop=, you will see that server2's cpuhog gets ~50% of available CPU time, and each of server1's cpuhogs get ~16% of CPU time. It may take a few seconds for things to balance out to that level. <span id="e47-hard-cpu-limits"></span> == 14.22. [E47] <span id="E47"></span> Hard CPU limits == To be completed. <span id="xx-not-included-yet"></span> == 14.23. [XX] Not Included Yet == [http://www.linux-vserver.org/index.php?page=Linux-VServer-Paper [Summary]] [http://www.linux-vserver.org/index.php?page=Linux-VServer-Paper-13 [Go Back]] [http://www.linux-vserver.org/index.php?page=Linux-VServer-Paper-15 [Next]] </div> <div id="footer"> <div class="copyleft"> <br /> Permission is granted to copy, distribute and/or modify this document under the terms of the<br /> [http://www.fsf.org/licenses/fdl.txt GNU Free Documentation License], Version 1.2 or any later version published by the Free Software Foundation. </div> ----- <div id="toolbar-bottom"> [[Linux-VServer-Paper-14?action=edit|Edit this document]] | [[Linux-VServer-Paper-14?action=history|View document history]]<br /> </div> Document last modified Sat, 16 Oct 2004 00:15:22<br /> <div class="form"> <br /> Search: </div> </div>
Summary:
Please note that all contributions to Linix VServer may be edited, altered, or removed by other contributors. If you do not want your writing to be edited mercilessly, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource (see
Linix VServer:Copyrights
for details).
Do not submit copyrighted work without permission!
Cancel
Editing help
(opens in new window)
Navigation menu
Page actions
Page
Discussion
Read
Edit
History
Page actions
Page
Discussion
More
Tools
Personal tools
Not logged in
Talk
Contributions
Create account
Log in
About
Overview
Paper
News
Developers
Donations
Search
Getting Started
Downloads
FAQs
Documentation
Support
Participate
How to participate
Report a Bug
Communicate
Teams/Projects
Hall of Fame
Resources
Archives
Recent Wiki Changes
Pastebin
Related Projects
VServer Hosting
Happy VServer Users
Tools
What links here
Related changes
Special pages
Page information