0081.html

From Linix VServer
Revision as of 01:58, 11 November 2025 by 146.75.42.132 (talk) (Restored content from Wayback Machine)
Jump to navigationJump to search

From: Herbert Poetzl (herbert_at_13thfloor.at)
Date: Thu 08 Jan 2004 - 19:12:45 GMT



Hi Community!


recently (end of december last year) somebody posted
a mystic message to one of the german webhosting lists
stating, that vserver is insecure, and that he would
suggest not to use it (no details where given) ...


it 'seems' that the poster was worried about the
ability to sniff network packets from other vservers
on the same host, when inside a vserver.


I would like to take this opportunity, to name some
'real' security issues, and what you can/should do to
avoid them ...


first linux-vserver is based on the linux capability
system and the protection this system adds to a
unpatches linux kernel, as well as to a linux-vserver
kernel. those capabilities allow the administrator of
a linux system (or vserver host) to limit the actions
even root can take. vserver tools 'automatically'
reduce the set of capabilities to a sane number.


CAP_CHOWN, CAP_DAC_OVERRIDE, CAP_DAC_READ_SEARCH,
CAP_FOWNER, CAP_FSETID, CAP_KILL, CAP_SETGID,
CAP_SETUID, CAP_NET_BIND_SERVICE, CAP_SYS_CHROOT,
CAP_SYS_PTRACE, CAP_SYS_TTY_CONFIG, CAP_LEASE


this does not contain the folowing capabilities for
security reasons (giving any of them lowers the
security of your vserver host, and makes the system
vulnerable)


CAP_SETPCAP
        transfering permitted capabilities


CAP_LINUX_IMMUTABLE
        modifying immutable and iunlink flags


CAP_NET_BROADCAST
        allow network broadcasting/multicasting


CAP_NET_ADMIN
        network interface configuration
        setting promiscuous mode (sniffing)
        multicasting and routing tables


CAP_NET_RAW
        use of raw and packet sockets


CAP_IPC_LOCK, CAP_IPC_OWNER
        ipc owner check and mlock


CAP_SYS_MODULE
        insert and removal of kernel modules


CAP_SYS_RAWIO
        ioperm/iopl access and usb messages


CAP_SYS_PACCT
        process accounting


CAP_SYS_ADMIN
        this list would be too long, it basically
        alows to do everything else, not mentioned
        in another capability.


CAP_SYS_BOOT
        allow reboot/halt


CAP_SYS_NICE
        allow raising priorities, and scheduler stuff


CAP_SYS_RESOURCE
        override resource limits
        override quota and reserved space
        modify data journaling, colsoles, keymap


CAP_SYS_TIME
        manipulation of the system clock


CAP_MKNOD
        creation of kernel nodes


best,
Herbert


_______________________________________________
Vserver mailing list
Vserver_at_list.linux-vserver.org
http://list.linux-vserver.org/mailman/listinfo/vserver



[[[../|Next/Previous Months]]] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Thu 08 Jan 2004 - 19:13:36 GMT by hypermail 2.1.3