0081.html: Difference between revisions

From Linix VServer
Jump to navigationJump to search
(Restored content from Wayback Machine)
Tag: Manual revert
(Restored content from Wayback Machine)
Tag: Manual revert
 
Line 1: Line 1:
<div class="links">
<div class="links">


'''[Vserver] Vserver and Security:'''<br />
'''[vserver] VServer on ARM / Fedora 13 - IT WORKS! :-D:'''<br />
 <span class="small">vserver development mailing list</span> <br />
 <span class="small">vserver development mailing list</span> <br />
[<nowiki/>[[../|Next/Previous Months]]] [<nowiki/>[http://www.solucorp.qc.ca/miscprj/s_context.hc Main vserver Project Homepage]] [<nowiki/>[http://www.solucorp.qc.ca/mlist/index.hc?list=vserver Howto Subscribe/Unsubscribe]] [<nowiki/>[http://www.paul.sladen.org/vserver/ Paul Sladen's vserver stuff]]
[<nowiki/>[[../|Next/Previous Months]]] [<nowiki/>[http://www.solucorp.qc.ca/miscprj/s_context.hc Main vserver Project Homepage]] [<nowiki/>[http://www.solucorp.qc.ca/mlist/index.hc?list=vserver Howto Subscribe/Unsubscribe]] [<nowiki/>[http://www.paul.sladen.org/vserver/ Paul Sladen's vserver stuff]]


</div>
</div>
<div align="center">
<div class="head">
 
<span id="vserver-vserver-on-arm-fedora-13---it-works--d"></span>
= [vserver] VServer on ARM / Fedora 13 - IT WORKS! :-D =


{| class="wikitable" border="2" width="100%"
* <span class="dfn">This message</span>: [ [[#start|Message body]] ] [ [[#options2|More options]] ]
|-
* <span class="dfn">Related messages</span>: [ [[0082.html|Next message]] ] [ [[0080.html|Previous message]] ] [ [[0082.html|Next in thread]] ] [ [[#replies|Replies]] ]
! [[../|About this list]]
! [[date.html|Date view]]
! [[index.html|Thread view]]
! [[subject.html|Subject view]]
! [[author.html|Author view]]
! [[attachment.html|Attachment view]]
|}




</div>
</div>
'''From:''' Herbert Poetzl ([mailto:herbert_at_13thfloor.at?Subject=Re:%20%5BVserver%5D%20Vserver%20and%20Security ''herbert_at_13thfloor.at''])<br />
<div class="mail">
'''Date:''' Thu 08 Jan 2004 - 19:12:45 GMT


* '''Previous message:''' [[0080.html|Herbert Poetzl: &quot;Re: [Vserver] 1.3.1: save_s_context: fork: Resource temporarily unavailable [was: Re: 1.3.1 with quota/limit patches]&quot;]]
<span id="from"> <span class="dfn">From</span>: Gordan Bobic &lt;[mailto:gordan_at_bobich.net?Subject=Re:%20%5Bvserver%5D%20VServer%20on%20ARM%20/%20Fedora%2013%20-%20IT%20WORKS!%20:-D gordan_at_bobich.net]&gt; </span><br />
* '''Next in thread:''' [[0083.html|Frank Matthieß: &quot;Kernel capabilties (Was: [Vserver] Vserver and Security)&quot;]]
<span id="date"><span class="dfn">Date</span>: Thu 24 Mar 2011 - 14:08:20 GMT</span><br />
* '''Reply:''' [[0083.html|Frank Matthieß: &quot;Kernel capabilties (Was: [Vserver] Vserver and Security)&quot;]]
<span id="message-id"><span class="dfn">Message-ID</span>: &lt;4D8B5054.2010108@bobich.net&gt; </span><br />
* '''Reply:''' [[0087.html|Gregory (Grisha) Trubetskoy: &quot;Re: [Vserver] Vserver and Security&quot;]]


I know my past posts on the subject haven't met much in terms of<br />
responses, but I thought I'd post this anyway.<br />


-----


Hi Community!<br />
As of version dietlibc-0.33-0.1600.20110311.fc16, dietlibc now builds<br />
cleanly on ARM, and util-vserver-0.30.216-0.pre2955 builds cleanly<br />
against it on ARM. Prior to the mentioned version of dietlibc,<br />
util-vserver didn't build against it correctly on ARM and had to be<br />
built against glibc, which was problematic.<br />




recently (end of december last year) somebody posted<br />
I am currently running 2.6.36.2-vs2.3.0.36.38.2 on F13 (with F13 guests)<br />
a mystic message to one of the german webhosting lists<br />
on ARM with dietlibc-0.33-0.1600.20110311.fc16 and<br />
stating, that vserver is insecure, and that he would<br />
util-vserver-0.30.216-0.pre2955, and as far as I can tell, everything<br />
suggest not to use it (no details where given) ...<br />
works perfectly.<br />




it 'seems' that the poster was worried about the<br />
Gordan<br />
ability to sniff network packets from other vservers<br />
<span id="received"><span class="dfn">Received on</span> Thu Mar 24 14:08:34 2011</span>
on the same host, when inside a vserver.<br />




I would like to take this opportunity, to name some<br />
</div>
'real' security issues, and what you can/should do to<br />
<div class="foot">
avoid them ...<br />
 
 
first linux-vserver is based on the linux capability<br />
system and the protection this system adds to a<br />
unpatches linux kernel, as well as to a linux-vserver<br />
kernel. those capabilities allow the administrator of<br />
a linux system (or vserver host) to limit the actions<br />
even root can take. vserver tools 'automatically'<br />
reduce the set of capabilities to a sane number.<br />
 
 
CAP_CHOWN, CAP_DAC_OVERRIDE, CAP_DAC_READ_SEARCH,<br />
CAP_FOWNER, CAP_FSETID, CAP_KILL, CAP_SETGID,<br />
CAP_SETUID, CAP_NET_BIND_SERVICE, CAP_SYS_CHROOT,<br />
CAP_SYS_PTRACE, CAP_SYS_TTY_CONFIG, CAP_LEASE<br />
 
 
this does not contain the folowing capabilities for<br />
security reasons (giving any of them lowers the<br />
security of your vserver host, and makes the system<br />
vulnerable)<br />
 
 
CAP_SETPCAP<br />
        transfering permitted capabilities<br />
 
 
CAP_LINUX_IMMUTABLE<br />
        modifying immutable and iunlink flags<br />
 
 
CAP_NET_BROADCAST<br />
        allow network broadcasting/multicasting<br />
 
 
CAP_NET_ADMIN<br />
        network interface configuration<br />
        setting promiscuous mode (sniffing)<br />
        multicasting and routing tables<br />
 
 
CAP_NET_RAW<br />
        use of raw and packet sockets<br />
 
 
CAP_IPC_LOCK, CAP_IPC_OWNER<br />
        ipc owner check and mlock<br />
 
 
CAP_SYS_MODULE<br />
        insert and removal of kernel modules<br />
 
 
CAP_SYS_RAWIO<br />
        ioperm/iopl access and usb messages<br />
 
 
CAP_SYS_PACCT<br />
        process accounting<br />
 
 
CAP_SYS_ADMIN<br />
        this list would be too long, it basically<br />
        alows to do everything else, not mentioned<br />
        in another capability.<br />
 
 
CAP_SYS_BOOT<br />
        allow reboot/halt<br />
 
 
CAP_SYS_NICE<br />
        allow raising priorities, and scheduler stuff<br />
 
 
CAP_SYS_RESOURCE<br />
        override resource limits<br />
        override quota and reserved space<br />
        modify data journaling, colsoles, keymap<br />
 
 
CAP_SYS_TIME<br />
        manipulation of the system clock<br />
 
 
CAP_MKNOD<br />
        creation of kernel nodes<br />
 
 
best,<br />
Herbert<br />
 
 
_______________________________________________<br />
Vserver mailing list<br />
[mailto:Vserver_at_list.linux-vserver.org?Subject=Re:%20%5BVserver%5D%20Vserver%20and%20Security Vserver_at_list.linux-vserver.org]<br />
http://list.linux-vserver.org/mailman/listinfo/vserver<br />
 
 
 
-----


* '''Previous message:''' [[0080.html|Herbert Poetzl: &quot;Re: [Vserver] 1.3.1: save_s_context: fork: Resource temporarily unavailable [was: Re: 1.3.1 with quota/limit patches]&quot;]]
* <span class="dfn">This message</span>: [ [[#start|Message body]] ]
* '''Next in thread:''' [[0083.html|Frank Matthieß: &quot;Kernel capabilties (Was: [Vserver] Vserver and Security)&quot;]]
* <span class="dfn">Next message</span>: [[0082.html|Gordan Bobic: &quot;Re: [vserver] VServer on ARM / Fedora 13 - IT WORKS! :-D&quot;]]
* '''Reply:''' [[0083.html|Frank Matthieß: &quot;Kernel capabilties (Was: [Vserver] Vserver and Security)&quot;]]
* <span class="dfn">Previous message</span>: [[0080.html|Ed W: &quot;[vserver] OT: IPMI Boards&quot;]]
* '''Reply:''' [[0087.html|Gregory (Grisha) Trubetskoy: &quot;Re: [Vserver] Vserver and Security&quot;]]
* <span class="dfn">Next in thread</span>: [[0082.html|Gordan Bobic: &quot;Re: [vserver] VServer on ARM / Fedora 13 - IT WORKS! :-D&quot;]]
 
* <span id="replies"></span><span class="dfn">Reply</span>: [[0082.html|Gordan Bobic: &quot;Re: [vserver] VServer on ARM / Fedora 13 - IT WORKS! :-D&quot;]]
<div align="center">
* <span class="dfn">Reply</span>: [[0084.html|Herbert Poetzl: &quot;Re: [vserver] VServer on ARM / Fedora 13 - IT WORKS! :-D&quot;]]


{| class="wikitable" border="2" width="100%"
* <span id="options2"></span><span class="dfn">Contemporary messages sorted</span>: [ [[date.html#81|By Date]] ] [ [[index.html#81|By Thread]] ] [ [[subject.html#81|By Subject]] ] [ [[author.html#81|By Author]] ] [ [[attachment.html|By messages with attachments]] ]
|-
! [[../|About this list]]
! [[date.html|Date view]]
! [[index.html|Thread view]]
! [[subject.html|Subject view]]
! [[author.html|Author view]]
! [[attachment.html|Attachment view]]
|}




Line 172: Line 60:


[<nowiki/>[[../|Next/Previous Months]]] [<nowiki/>[http://www.solucorp.qc.ca/miscprj/s_context.hc Main vserver Project Homepage]] [<nowiki/>[http://www.solucorp.qc.ca/mlist/index.hc?list=vserver Howto Subscribe/Unsubscribe]] [<nowiki/>[http://www.paul.sladen.org/vserver/ Paul Sladen's vserver stuff]]<br />
[<nowiki/>[[../|Next/Previous Months]]] [<nowiki/>[http://www.solucorp.qc.ca/miscprj/s_context.hc Main vserver Project Homepage]] [<nowiki/>[http://www.solucorp.qc.ca/mlist/index.hc?list=vserver Howto Subscribe/Unsubscribe]] [<nowiki/>[http://www.paul.sladen.org/vserver/ Paul Sladen's vserver stuff]]<br />
<span class="small">Generated on Thu 08 Jan 2004 - 19:13:36 GMT by [http://www.hypermail.org/ hypermail 2.1.3]</span>
<span class="small">Generated on Thu 24 Mar 2011 - 14:08:35 GMT by [http://www.hypermail.org/ hypermail 2.1.8]</span>


</div>
</div>

Latest revision as of 02:10, 11 November 2025

[vserver] VServer on ARM / Fedora 13 - IT WORKS! :-D[edit]


From: Gordan Bobic <gordan_at_bobich.net>
Date: Thu 24 Mar 2011 - 14:08:20 GMT
Message-ID: <4D8B5054.2010108@bobich.net>

I know my past posts on the subject haven't met much in terms of
responses, but I thought I'd post this anyway.


As of version dietlibc-0.33-0.1600.20110311.fc16, dietlibc now builds
cleanly on ARM, and util-vserver-0.30.216-0.pre2955 builds cleanly
against it on ARM. Prior to the mentioned version of dietlibc,
util-vserver didn't build against it correctly on ARM and had to be
built against glibc, which was problematic.


I am currently running 2.6.36.2-vs2.3.0.36.38.2 on F13 (with F13 guests)
on ARM with dietlibc-0.33-0.1600.20110311.fc16 and
util-vserver-0.30.216-0.pre2955, and as far as I can tell, everything
works perfectly.


Gordan
Received on Thu Mar 24 14:08:34 2011


[[[../|Next/Previous Months]]] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Thu 24 Mar 2011 - 14:08:35 GMT by hypermail 2.1.8