0081.html: Difference between revisions

From Linix VServer
Jump to navigationJump to search
(Restored content from Wayback Machine)
(Restored content from Wayback Machine)
Tag: Manual revert
Line 1: Line 1:
<div class="links">
<div class="links">


'''[vserver] VServer on ARM / Fedora 13 - IT WORKS! :-D:'''<br />
'''[Vserver] Vserver and Security:'''<br />
 <span class="small">vserver development mailing list</span> <br />
 <span class="small">vserver development mailing list</span> <br />
[<nowiki/>[[../|Next/Previous Months]]] [<nowiki/>[http://www.solucorp.qc.ca/miscprj/s_context.hc Main vserver Project Homepage]] [<nowiki/>[http://www.solucorp.qc.ca/mlist/index.hc?list=vserver Howto Subscribe/Unsubscribe]] [<nowiki/>[http://www.paul.sladen.org/vserver/ Paul Sladen's vserver stuff]]
[<nowiki/>[[../|Next/Previous Months]]] [<nowiki/>[http://www.solucorp.qc.ca/miscprj/s_context.hc Main vserver Project Homepage]] [<nowiki/>[http://www.solucorp.qc.ca/mlist/index.hc?list=vserver Howto Subscribe/Unsubscribe]] [<nowiki/>[http://www.paul.sladen.org/vserver/ Paul Sladen's vserver stuff]]


</div>
</div>
<div class="head">
<div align="center">
 
{| class="wikitable" border="2" width="100%"
|-
! [[../|About this list]]
! [[date.html|Date view]]
! [[index.html|Thread view]]
! [[subject.html|Subject view]]
! [[author.html|Author view]]
! [[attachment.html|Attachment view]]
|}
 
 
</div>
'''From:''' Herbert Poetzl ([mailto:herbert_at_13thfloor.at?Subject=Re:%20%5BVserver%5D%20Vserver%20and%20Security ''herbert_at_13thfloor.at''])<br />
'''Date:''' Thu 08 Jan 2004 - 19:12:45 GMT
 
* '''Previous message:''' [[0080.html|Herbert Poetzl: &quot;Re: [Vserver] 1.3.1: save_s_context: fork: Resource temporarily unavailable [was: Re: 1.3.1 with quota/limit patches]&quot;]]
* '''Next in thread:''' [[0083.html|Frank Matthieß: &quot;Kernel capabilties (Was: [Vserver] Vserver and Security)&quot;]]
* '''Reply:''' [[0083.html|Frank Matthieß: &quot;Kernel capabilties (Was: [Vserver] Vserver and Security)&quot;]]
* '''Reply:''' [[0087.html|Gregory (Grisha) Trubetskoy: &quot;Re: [Vserver] Vserver and Security&quot;]]
 
 
-----
 
Hi Community!<br />
 
 
recently (end of december last year) somebody posted<br />
a mystic message to one of the german webhosting lists<br />
stating, that vserver is insecure, and that he would<br />
suggest not to use it (no details where given) ...<br />
 
 
it 'seems' that the poster was worried about the<br />
ability to sniff network packets from other vservers<br />
on the same host, when inside a vserver.<br />
 
 
I would like to take this opportunity, to name some<br />
'real' security issues, and what you can/should do to<br />
avoid them ...<br />
 
 
first linux-vserver is based on the linux capability<br />
system and the protection this system adds to a<br />
unpatches linux kernel, as well as to a linux-vserver<br />
kernel. those capabilities allow the administrator of<br />
a linux system (or vserver host) to limit the actions<br />
even root can take. vserver tools 'automatically'<br />
reduce the set of capabilities to a sane number.<br />
 
 
CAP_CHOWN, CAP_DAC_OVERRIDE, CAP_DAC_READ_SEARCH,<br />
CAP_FOWNER, CAP_FSETID, CAP_KILL, CAP_SETGID,<br />
CAP_SETUID, CAP_NET_BIND_SERVICE, CAP_SYS_CHROOT,<br />
CAP_SYS_PTRACE, CAP_SYS_TTY_CONFIG, CAP_LEASE<br />
 
 
this does not contain the folowing capabilities for<br />
security reasons (giving any of them lowers the<br />
security of your vserver host, and makes the system<br />
vulnerable)<br />
 
 
CAP_SETPCAP<br />
        transfering permitted capabilities<br />
 
 
CAP_LINUX_IMMUTABLE<br />
        modifying immutable and iunlink flags<br />
 
 
CAP_NET_BROADCAST<br />
        allow network broadcasting/multicasting<br />
 
 
CAP_NET_ADMIN<br />
        network interface configuration<br />
        setting promiscuous mode (sniffing)<br />
        multicasting and routing tables<br />
 
 
CAP_NET_RAW<br />
        use of raw and packet sockets<br />
 
 
CAP_IPC_LOCK, CAP_IPC_OWNER<br />
        ipc owner check and mlock<br />
 
 
CAP_SYS_MODULE<br />
        insert and removal of kernel modules<br />
 
 
CAP_SYS_RAWIO<br />
        ioperm/iopl access and usb messages<br />
 
 
CAP_SYS_PACCT<br />
        process accounting<br />
 
 
CAP_SYS_ADMIN<br />
        this list would be too long, it basically<br />
        alows to do everything else, not mentioned<br />
        in another capability.<br />
 
 
CAP_SYS_BOOT<br />
        allow reboot/halt<br />
 
 
CAP_SYS_NICE<br />
        allow raising priorities, and scheduler stuff<br />


<span id="vserver-vserver-on-arm-fedora-13---it-works--d"></span>
= [vserver] VServer on ARM / Fedora 13 - IT WORKS! :-D =


* <span class="dfn">This message</span>: [ [[#start|Message body]] ] [ [[#options2|More options]] ]
CAP_SYS_RESOURCE<br />
* <span class="dfn">Related messages</span>: [ [[0082.html|Next message]] ] [ [[0080.html|Previous message]] ] [ [[0082.html|Next in thread]] ] [ [[#replies|Replies]] ]
        override resource limits<br />
        override quota and reserved space<br />
        modify data journaling, colsoles, keymap<br />




</div>
CAP_SYS_TIME<br />
<div class="mail">
        manipulation of the system clock<br />


<span id="from"> <span class="dfn">From</span>: Gordan Bobic &lt;[mailto:gordan_at_bobich.net?Subject=Re:%20%5Bvserver%5D%20VServer%20on%20ARM%20/%20Fedora%2013%20-%20IT%20WORKS!%20:-D gordan_at_bobich.net]&gt; </span><br />
<span id="date"><span class="dfn">Date</span>: Thu 24 Mar 2011 - 14:08:20 GMT</span><br />
<span id="message-id"><span class="dfn">Message-ID</span>: &lt;4D8B5054.2010108@bobich.net&gt; </span><br />


I know my past posts on the subject haven't met much in terms of<br />
CAP_MKNOD<br />
responses, but I thought I'd post this anyway.<br />
        creation of kernel nodes<br />




As of version dietlibc-0.33-0.1600.20110311.fc16, dietlibc now builds<br />
best,<br />
cleanly on ARM, and util-vserver-0.30.216-0.pre2955 builds cleanly<br />
Herbert<br />
against it on ARM. Prior to the mentioned version of dietlibc,<br />
util-vserver didn't build against it correctly on ARM and had to be<br />
built against glibc, which was problematic.<br />




I am currently running 2.6.36.2-vs2.3.0.36.38.2 on F13 (with F13 guests)<br />
_______________________________________________<br />
on ARM with dietlibc-0.33-0.1600.20110311.fc16 and<br />
Vserver mailing list<br />
util-vserver-0.30.216-0.pre2955, and as far as I can tell, everything<br />
[mailto:Vserver_at_list.linux-vserver.org?Subject=Re:%20%5BVserver%5D%20Vserver%20and%20Security Vserver_at_list.linux-vserver.org]<br />
works perfectly.<br />
http://list.linux-vserver.org/mailman/listinfo/vserver<br />




Gordan<br />
<span id="received"><span class="dfn">Received on</span> Thu Mar 24 14:08:34 2011</span>


-----


</div>
* '''Previous message:''' [[0080.html|Herbert Poetzl: &quot;Re: [Vserver] 1.3.1: save_s_context: fork: Resource temporarily unavailable [was: Re: 1.3.1 with quota/limit patches]&quot;]]
<div class="foot">
* '''Next in thread:''' [[0083.html|Frank Matthieß: &quot;Kernel capabilties (Was: [Vserver] Vserver and Security)&quot;]]
* '''Reply:''' [[0083.html|Frank Matthieß: &quot;Kernel capabilties (Was: [Vserver] Vserver and Security)&quot;]]
* '''Reply:''' [[0087.html|Gregory (Grisha) Trubetskoy: &quot;Re: [Vserver] Vserver and Security&quot;]]


* <span class="dfn">This message</span>: [ [[#start|Message body]] ]
<div align="center">
* <span class="dfn">Next message</span>: [[0082.html|Gordan Bobic: &quot;Re: [vserver] VServer on ARM / Fedora 13 - IT WORKS! :-D&quot;]]
* <span class="dfn">Previous message</span>: [[0080.html|Ed W: &quot;[vserver] OT: IPMI Boards&quot;]]
* <span class="dfn">Next in thread</span>: [[0082.html|Gordan Bobic: &quot;Re: [vserver] VServer on ARM / Fedora 13 - IT WORKS! :-D&quot;]]
* <span id="replies"></span><span class="dfn">Reply</span>: [[0082.html|Gordan Bobic: &quot;Re: [vserver] VServer on ARM / Fedora 13 - IT WORKS! :-D&quot;]]
* <span class="dfn">Reply</span>: [[0084.html|Herbert Poetzl: &quot;Re: [vserver] VServer on ARM / Fedora 13 - IT WORKS! :-D&quot;]]


* <span id="options2"></span><span class="dfn">Contemporary messages sorted</span>: [ [[date.html#81|By Date]] ] [ [[index.html#81|By Thread]] ] [ [[subject.html#81|By Subject]] ] [ [[author.html#81|By Author]] ] [ [[attachment.html|By messages with attachments]] ]
{| class="wikitable" border="2" width="100%"
|-
! [[../|About this list]]
! [[date.html|Date view]]
! [[index.html|Thread view]]
! [[subject.html|Subject view]]
! [[author.html|Author view]]
! [[attachment.html|Attachment view]]
|}




Line 60: Line 172:


[<nowiki/>[[../|Next/Previous Months]]] [<nowiki/>[http://www.solucorp.qc.ca/miscprj/s_context.hc Main vserver Project Homepage]] [<nowiki/>[http://www.solucorp.qc.ca/mlist/index.hc?list=vserver Howto Subscribe/Unsubscribe]] [<nowiki/>[http://www.paul.sladen.org/vserver/ Paul Sladen's vserver stuff]]<br />
[<nowiki/>[[../|Next/Previous Months]]] [<nowiki/>[http://www.solucorp.qc.ca/miscprj/s_context.hc Main vserver Project Homepage]] [<nowiki/>[http://www.solucorp.qc.ca/mlist/index.hc?list=vserver Howto Subscribe/Unsubscribe]] [<nowiki/>[http://www.paul.sladen.org/vserver/ Paul Sladen's vserver stuff]]<br />
<span class="small">Generated on Thu 24 Mar 2011 - 14:08:35 GMT by [http://www.hypermail.org/ hypermail 2.1.8]</span>
<span class="small">Generated on Thu 08 Jan 2004 - 19:13:36 GMT by [http://www.hypermail.org/ hypermail 2.1.3]</span>


</div>
</div>

Revision as of 01:58, 11 November 2025

From: Herbert Poetzl (herbert_at_13thfloor.at)
Date: Thu 08 Jan 2004 - 19:12:45 GMT



Hi Community!


recently (end of december last year) somebody posted
a mystic message to one of the german webhosting lists
stating, that vserver is insecure, and that he would
suggest not to use it (no details where given) ...


it 'seems' that the poster was worried about the
ability to sniff network packets from other vservers
on the same host, when inside a vserver.


I would like to take this opportunity, to name some
'real' security issues, and what you can/should do to
avoid them ...


first linux-vserver is based on the linux capability
system and the protection this system adds to a
unpatches linux kernel, as well as to a linux-vserver
kernel. those capabilities allow the administrator of
a linux system (or vserver host) to limit the actions
even root can take. vserver tools 'automatically'
reduce the set of capabilities to a sane number.


CAP_CHOWN, CAP_DAC_OVERRIDE, CAP_DAC_READ_SEARCH,
CAP_FOWNER, CAP_FSETID, CAP_KILL, CAP_SETGID,
CAP_SETUID, CAP_NET_BIND_SERVICE, CAP_SYS_CHROOT,
CAP_SYS_PTRACE, CAP_SYS_TTY_CONFIG, CAP_LEASE


this does not contain the folowing capabilities for
security reasons (giving any of them lowers the
security of your vserver host, and makes the system
vulnerable)


CAP_SETPCAP
        transfering permitted capabilities


CAP_LINUX_IMMUTABLE
        modifying immutable and iunlink flags


CAP_NET_BROADCAST
        allow network broadcasting/multicasting


CAP_NET_ADMIN
        network interface configuration
        setting promiscuous mode (sniffing)
        multicasting and routing tables


CAP_NET_RAW
        use of raw and packet sockets


CAP_IPC_LOCK, CAP_IPC_OWNER
        ipc owner check and mlock


CAP_SYS_MODULE
        insert and removal of kernel modules


CAP_SYS_RAWIO
        ioperm/iopl access and usb messages


CAP_SYS_PACCT
        process accounting


CAP_SYS_ADMIN
        this list would be too long, it basically
        alows to do everything else, not mentioned
        in another capability.


CAP_SYS_BOOT
        allow reboot/halt


CAP_SYS_NICE
        allow raising priorities, and scheduler stuff


CAP_SYS_RESOURCE
        override resource limits
        override quota and reserved space
        modify data journaling, colsoles, keymap


CAP_SYS_TIME
        manipulation of the system clock


CAP_MKNOD
        creation of kernel nodes


best,
Herbert


_______________________________________________
Vserver mailing list
Vserver_at_list.linux-vserver.org
http://list.linux-vserver.org/mailman/listinfo/vserver



[[[../|Next/Previous Months]]] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Thu 08 Jan 2004 - 19:13:36 GMT by hypermail 2.1.3