lkml.org 
[lkml]   [2009]   [Mar]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: How much of a mess does OpenVZ make? ;) Was: What can OpenVZ do?

>> 1. cap_sys_admin check is unfortunate. In discussions about Oren's
>> patchset we've agreed that not having that check from the outset forces
>> us to consider security with each new patch and feature, which is a good
>> thing.
>
> Removing CAP_SYS_ADMIN on restore?

we've kept the capabilities in our patchset but the user tools doing checkpoint
and restart are setcap'ed appropriately to be able to do different things like :

clone() the namespaces
mount /dev/mqueue
interact with net_ns
etc.

at restart, the task are restarted through execve() so they loose their
capabilities automatically.

but I think we could drop the CAP_SYS_ADMIN tests for some namespaces,
uts and ipc are good candidates. I guess network should require some
privilege.

C.


\
 
 \ /
  Last update: 2009-03-03 17:21    [W:0.111 / U:0.080 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site