Difference between revisions of "util-vserver:Capabilities and Flags"
From Linux-VServer
Marc hamelin (Talk | contribs) (→Setting POSIX capabilities (bcaps)) |
Daniel hozac (Talk | contribs) m (Reverted edits by Marc hamelin (Talk) to last revision by Gebura) |
||
| Line 42: | Line 42: | ||
SETUID | SETUID | ||
NET_BIND_SERVICE | NET_BIND_SERVICE | ||
| − | |||
SYS_CHROOT | SYS_CHROOT | ||
SYS_PTRACE | SYS_PTRACE | ||
| Line 49: | Line 48: | ||
LEASE | LEASE | ||
AUDIT_WRITE | AUDIT_WRITE | ||
| − | |||
| − | |||
=== Setting network capabilities (ncaps) === | === Setting network capabilities (ncaps) === | ||
Revision as of 09:37, 3 October 2011
This page discusses how to set capabilities and flags for a util-vserver guest. Also check http://www.nongnu.org/util-vserver/doc/conf/configuration.html for additional information. A couple of general rules applies to all of the files described on this page:
- The filenames are all relative to the guest's configuration directory, which typically is
/etc/vservers/<guest>but by default/usr/local/etc/vservers/<guest>when built from source. - One capability/flag per line
- To remove something set by default, prefix it with ~, for instance:
echo ~SET_UTSNAME >> ccapabilities
- Comments can be added with #:
echo \# Disable utsname configuration >> ccapabilities
- To set a specific bit which does not yet have a name in util-vserver, you can use the following notation to set bit 6:
echo ^6 >> ncapabilities
Contents |
Setting context capabilities (ccaps)
- Add the capabilities to a file named
ccapabilities:
echo SYSLOG >> ccapabilities
- The default ccaps are:
SET_UTSNAME RAW_ICMP
Setting context flags (cflags)
- Add the flags to a file named
flags:
echo VIRT_MEM >> flags
- The default cflags are (in addition to the defaults set by the kernel):
HIDE_NETIF
Setting network flags (nflags)
- Add the flags to a file named
nflags:
echo HIDE_NETIF >> nflags
- The default nflags are:
HIDE_NETIF
Setting POSIX capabilities (bcaps)
- Add the capabilities to a file named
bcapabilities:
echo CHOWN >> bcapabilities
- The default bcaps are:
CHOWN DAC_OVERRIDE DAC_READ_SEARCH FOWNER FSETID KILL SETGID SETUID NET_BIND_SERVICE SYS_CHROOT SYS_PTRACE SYS_BOOT SYS_TTY_CONFIG LEASE AUDIT_WRITE
Setting network capabilities (ncaps)
- Add the capabilities to a file named
ncapabilities:
echo ^12 >> ncapabilities
- There are no default ncaps.
Modify flags without restarting the vservers
If you would like to edit those flags without restarting the vservers, you can use vattribute and nattribute. See util-vserver:Cheatsheet
