Difference between revisions of "util-vserver:Capabilities and Flags"

Revision as of 10:12, 7 September 2008

This page discusses how to set capabilities and flags for a util-vserver guest. Also check http://www.nongnu.org/util-vserver/doc/conf/configuration.html for additional information. A couple of general rules applies to all of the files described on this page:

• The filenames are all relative to the guest's configuration directory, which typically is /etc/vservers/<guest> but by default /usr/local/etc/vservers/<guest> when built from source.
• One capability/flag per line
• To remove something set by default, prefix it with ~, for instance:

echo ~SET_UTSNAME >> ccapabilities

• Comments can be added with #:

echo \# Disable utsname configuration >> ccapabilities

• To set a specific bit which does not yet have a name in util-vserver, you can use the following notation to set bit 6:

echo ^6 >> ncapabilities

Setting context capabilities (ccaps)

• Add the capabilities to a file named ccapabilities:

echo SYSLOG >> ccapabilities

• The default ccaps are:

SET_UTSNAME
RAW_ICMP

Setting context flags (cflags)

• Add the flags to a file named flags:

echo VIRT_MEM >> flags

• The default cflags are (in addition to the defaults set by the kernel):

HIDE_NETIF

Setting network flags (nflags)

• Add the flags to a file named nflags:

echo HIDE_NETIF >> nflags

• The default nflags are:

HIDE_NETIF

Setting POSIX capabilities (bcaps)

• Add the capabilities to a file named bcapabilities:

echo CHOWN >> bcapabilities

• The default bcaps are:

CHOWN
DAC_OVERRIDE
DAC_READ_SEARCH
FOWNER
FSETID
KILL
SETGID
SETUID
NET_BIND_SERVICE
SYS_CHROOT
SYS_PTRACE
SYS_BOOT
SYS_TTY_CONFIG
LEASE
AUDIT_WRITE

Setting network capabilities (ncaps)

• Add the capabilities to a file named ncapabilities:

echo ^12 >> ncapabilities

• There are no default ncaps.