Difference between revisions of "util-vserver:Capabilities and Flags"
From Linux-VServer
Marc hamelin (Talk | contribs) (→Setting POSIX capabilities (bcaps)) |
|||
| (One intermediate revision by one user not shown) | |||
| Line 42: | Line 42: | ||
SETUID | SETUID | ||
NET_BIND_SERVICE | NET_BIND_SERVICE | ||
| − | |||
SYS_CHROOT | SYS_CHROOT | ||
SYS_PTRACE | SYS_PTRACE | ||
| Line 49: | Line 48: | ||
LEASE | LEASE | ||
AUDIT_WRITE | AUDIT_WRITE | ||
| − | |||
| − | |||
=== Setting network capabilities (ncaps) === | === Setting network capabilities (ncaps) === | ||
| Line 59: | Line 56: | ||
=== Modify flags without restarting the vservers === | === Modify flags without restarting the vservers === | ||
If you would like to edit those flags without restarting the vservers, you can use vattribute and nattribute. See [[util-vserver:Cheatsheet]] | If you would like to edit those flags without restarting the vservers, you can use vattribute and nattribute. See [[util-vserver:Cheatsheet]] | ||
| + | |||
| + | [[Category:Configuration]] | ||
Latest revision as of 22:20, 21 October 2011
This page discusses how to set capabilities and flags for a util-vserver guest. Also check http://www.nongnu.org/util-vserver/doc/conf/configuration.html for additional information. A couple of general rules applies to all of the files described on this page:
- The filenames are all relative to the guest's configuration directory, which typically is
/etc/vservers/<guest>but by default/usr/local/etc/vservers/<guest>when built from source. - One capability/flag per line
- To remove something set by default, prefix it with ~, for instance:
echo ~SET_UTSNAME >> ccapabilities
- Comments can be added with #:
echo \# Disable utsname configuration >> ccapabilities
- To set a specific bit which does not yet have a name in util-vserver, you can use the following notation to set bit 6:
echo ^6 >> ncapabilities
Contents |
[edit] Setting context capabilities (ccaps)
- Add the capabilities to a file named
ccapabilities:
echo SYSLOG >> ccapabilities
- The default ccaps are:
SET_UTSNAME RAW_ICMP
[edit] Setting context flags (cflags)
- Add the flags to a file named
flags:
echo VIRT_MEM >> flags
- The default cflags are (in addition to the defaults set by the kernel):
HIDE_NETIF
[edit] Setting network flags (nflags)
- Add the flags to a file named
nflags:
echo HIDE_NETIF >> nflags
- The default nflags are:
HIDE_NETIF
[edit] Setting POSIX capabilities (bcaps)
- Add the capabilities to a file named
bcapabilities:
echo CHOWN >> bcapabilities
- The default bcaps are:
CHOWN DAC_OVERRIDE DAC_READ_SEARCH FOWNER FSETID KILL SETGID SETUID NET_BIND_SERVICE SYS_CHROOT SYS_PTRACE SYS_BOOT SYS_TTY_CONFIG LEASE AUDIT_WRITE
[edit] Setting network capabilities (ncaps)
- Add the capabilities to a file named
ncapabilities:
echo ^12 >> ncapabilities
- There are no default ncaps.
[edit] Modify flags without restarting the vservers
If you would like to edit those flags without restarting the vservers, you can use vattribute and nattribute. See util-vserver:Cheatsheet
