Difference between revisions of "util-vserver:Capabilities and Flags"

From Linux-VServer

Jump to: navigation, search
m (Protected "util-vserver:Capabilities and Flags": frequent SPAM target protected [edit=autoconfirmed:move=autoconfirmed])
 
(3 intermediate revisions by 3 users not shown)
Line 53: Line 53:
 
  echo ^12 >> ncapabilities
 
  echo ^12 >> ncapabilities
 
* There are no default ncaps.
 
* There are no default ncaps.
 +
 +
=== Modify flags without restarting the vservers ===
 +
If you would like to edit those flags without restarting the vservers, you can use vattribute and nattribute. See [[util-vserver:Cheatsheet]]
 +
 +
[[Category:Configuration]]

Latest revision as of 22:20, 21 October 2011

This page discusses how to set capabilities and flags for a util-vserver guest. Also check http://www.nongnu.org/util-vserver/doc/conf/configuration.html for additional information. A couple of general rules applies to all of the files described on this page:

  • The filenames are all relative to the guest's configuration directory, which typically is /etc/vservers/<guest> but by default /usr/local/etc/vservers/<guest> when built from source.
  • One capability/flag per line
  • To remove something set by default, prefix it with ~, for instance:
echo ~SET_UTSNAME >> ccapabilities
  • Comments can be added with #:
echo \# Disable utsname configuration >> ccapabilities
  • To set a specific bit which does not yet have a name in util-vserver, you can use the following notation to set bit 6:
echo ^6 >> ncapabilities

Contents

[edit] Setting context capabilities (ccaps)

  • Add the capabilities to a file named ccapabilities:
echo SYSLOG >> ccapabilities
  • The default ccaps are:
SET_UTSNAME
RAW_ICMP

[edit] Setting context flags (cflags)

  • Add the flags to a file named flags:
echo VIRT_MEM >> flags
  • The default cflags are (in addition to the defaults set by the kernel):
HIDE_NETIF

[edit] Setting network flags (nflags)

  • Add the flags to a file named nflags:
echo HIDE_NETIF >> nflags
  • The default nflags are:
HIDE_NETIF

[edit] Setting POSIX capabilities (bcaps)

  • Add the capabilities to a file named bcapabilities:
echo CHOWN >> bcapabilities
  • The default bcaps are:
CHOWN
DAC_OVERRIDE
DAC_READ_SEARCH
FOWNER
FSETID
KILL
SETGID
SETUID
NET_BIND_SERVICE
SYS_CHROOT
SYS_PTRACE
SYS_BOOT
SYS_TTY_CONFIG
LEASE
AUDIT_WRITE

[edit] Setting network capabilities (ncaps)

  • Add the capabilities to a file named ncapabilities:
echo ^12 >> ncapabilities
  • There are no default ncaps.

[edit] Modify flags without restarting the vservers

If you would like to edit those flags without restarting the vservers, you can use vattribute and nattribute. See util-vserver:Cheatsheet

Personal tools