Difference between revisions of "Talk:Secure chroot Barrier"

From Linux-VServer

Jump to: navigation, search
Line 13: Line 13:
  
 
i/o ports not restricted?
 
i/o ports not restricted?
 +
 +
 +
# Accoring to http://oldwiki.linux-vserver.org/Step-by-Step+Guide+2.6: "On Linux 2.6 this isn't really necessary, since another mechanism is used to lock in the guests anyway" - maybe someone could elaborate on this and put it in the article, please

Revision as of 17:22, 1 August 2008

  1. setattr --barrier /vservers
  2. showattr /vservers

Seems insufficient. You need to set --barrier for every existing and NEW directory except those below /vservers/. as the suggested command protects only against chdir ..

Why? The fchdir.

Am I right?

once you gain root inside the scure chroot:

may you gain access to the device node?

i/o ports not restricted?


  1. Accoring to http://oldwiki.linux-vserver.org/Step-by-Step+Guide+2.6: "On Linux 2.6 this isn't really necessary, since another mechanism is used to lock in the guests anyway" - maybe someone could elaborate on this and put it in the article, please
Personal tools