Linux-VServer-Paper-14: Difference between revisions
From Linix VServer
Jump to navigationJump to search
(Restored content from Wayback Machine) |
(No difference)
|
Latest revision as of 22:16, 10 November 2025
14. Step by Step Examples[edit]
The following examples can be reproduced on recent Linux systems without any modifications.
14.0. [E01] Linux Caps Example[edit]
# grep Cap /proc/self/status CapInh: 0000000000000000 CapPrm: 00000000fffffeff CapEff: 00000000fffffeff
14.1. [E02] Manipulating Linux Caps[edit]
# lcap -z # grep Cap /proc/self/status CapInh: 0000000000000000 CapPrm: 0000000000000000 CapEff: 0000000000000000
14.2. [E03] CAP_MKNOD Example[edit]
# lcap -z CAP_MKNOD # mknod /tmp/null b 0 0 mknod: /tmp/null: Operation not permitted
14.3. [E11] Resource Limits via BASH[edit]
bash-2.05# ulimit -H -a core file size (blocks) unlimited data seg size (kbytes) unlimited file size (blocks) unlimited max locked memory (kbytes) unlimited max memory size (kbytes) unlimited open files 1024 pipe size (512 bytes) 8 stack size (kbytes) unlimited cpu time (seconds) unlimited max user processes 256 virtual memory (kbytes) unlimited
14.4. [E12] Example CPU Time Limit[edit]
bash-2.05# ulimit -t 10 bash-2.05# /tmp/cpuhog Killed
14.5. [E13] Normal File without Attributes[edit]
# touch /tmp/file # lsattr /tmp/file ------------- /tmp/file # rm -f /tmp/file
14.6. [E14] Immutable File Attribute[edit]
# touch /tmp/file # chattr +i /tmp/file # lsattr /tmp/file ----i-------- /tmp/file # rm -f /tmp/file rm: unable to remove `/tmp/file': Operation not permitted # chattr -i /tmp/file # rm -f /tmp/file
14.7. [E15] Chroot Example[edit]
# mkdir /tmp/root # mkdir /tmp/root/bin /tmp/root/lib # cp -a /lib/* /tmp/root/lib/ # cp -a /bin/bash /tmp/root/bin/ # cp -a /bin/ls /tmp/root/bin/ # chroot /tmp/root /bin/bash bash-2.05# ls / bin lib
The now following examples require a Linux-VServer kernel and recent util-vserver tools.
14.8. [E21] Process Isolation[edit]
# chcontext ps auxw New security context is 49152 USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 37 11.5 1.7 2408 500 tts/0 R 02:36 0:00 ps auxw
14.9. [E22] Dual Context Isolation[edit]
# chcontext --ctx 100 sleep 111 & # chcontext --ctx 200 sleep 222 & # chcontext --ctx 100 ps auxw New security context is 100 USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 23 0.3 1.5 2748 436 tts/0 S 18:47 0:00 sleep 111 root 26 28.0 2.2 2476 664 tts/0 R 18:48 0:00 ps auxw
14.10. [E23] Fake Init Process[edit]
# chcontext --flag fakeinit ps auxw New security context is 49153 USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 1 0.0 0.4 2756 552 ? S 19:09 0:04 init
14.11. [E24] Network Isolation[edit]
# ifconfig lo 127.0.0.1 # ifconfig eth0 10.0.0.2 # ping -c 1 10.0.0.1 PING 10.0.0.1 (10.0.0.1) from 10.0.0.2 : 56(84) bytes of data. 64 bytes from 10.0.0.1: icmp_seq=0 ttl=64 time=4.814 msec # chbind --ip 127.0.0.1 ping -c 1 10.0.0.1 ipv4root is now 127.0.0.1 connect: Invalid argument
14.12. [E31] Context File Tagging[edit]
# mount -o tagxid /dev/hd1/part1 /mnt/ # mkdir /mnt/test # touch /mnt/test/file # lsctx /mnt/test/file #0 /mnt/test/file # chcontext --ctx 100 touch /mnt/test/file_100 # lsctx -R /mnt/test #0 /mnt/test/file #100 /mnt/test/file_100
14.13. [E32] XID File Permissions[edit]
# mount -o tagxid /dev/hd1/part1 /mnt/ # chcontext --ctx 100 mkdir /mnt/100 New security context is 100 # chcontext --ctx 200 touch /mnt/100/file New security context is 200 touch: /mnt/100/file: Permission denied
14.14. [E33] Context Flags[edit]
# chcontext --flag ^24 cat /proc/mounts New security context is 49154
14.15. [E34] Context Capabilities[edit]
# chcontext --flag ^24 cat /proc/mounts New security context is 49154
14.16. [E41] Context Accounting[edit]
# cat /proc/virtual/1001/cacct UNSPEC: 0/0 0/0 0/0 UNIX: 25/1626 25/1626 0/0 INET: 12/531 48/1653 55/1625 INET6: 0/0 0/0 0/0 OTHER: 0/0 0/0 0/0
14.17. [E42] Context Limits[edit]
# cat /proc/virtual/1001/limit PROC: 17 22 -1 0 VM: 14290 16502 17000 5 VML: 0 0 -1 0 RSS: 5455 7816 -1 0 FILES: 144 171 -1 0 OFD: -569 -541 -1 0
14.18. [E43] Uptime Virtualization[edit]
# uptime 20:31:11 up 21 min, load average: 0.20, 0.05, 0.01 # chcontext --ctx 100 --flag ^17 bash -c "sleep 100; uptime" New security context is 100 20:33:13 up 1 min, load average: 0.02, 0.03, 0.00
14.19. [E44] ProcFS Guest Security[edit]
# setattr --hide /proc/* # chcontext --ctx 100 ls /proc New security context is 100 527 self
14.20. [E45] ProcFS Host Security[edit]
# setattr --hide --~admin /proc/* # ls /proc 1 10 12 13 16 2 3 4 5 532 6 7 8 9 self
14.21. [E46] token CPU allocation[edit]
First, you need to set up two vservers with the =sched= flag set, on a current vs1.9 patched 2.6 kernel. This did work once on 2.4.24-ck1, and 2.4.*-ac, but such support is not currently maintained.
This example assumes that two servers have been allocated equal CPU time (FIXME - how is this configured?)
# vserver server1 enter server1# cpuhog& cpuhog& cpuhog& exit& # vserver server2 enter server2# cpuhog& exit # vtop
In =vtop=, you will see that server2's cpuhog gets ~50% of available CPU time, and each of server1's cpuhogs get ~16% of CPU time. It may take a few seconds for things to balance out to that level.
14.22. [E47] Hard CPU limits[edit]
To be completed.
14.23. [XX] Not Included Yet[edit]