Difference between revisions of "util-vserver:Capabilities and Flags"

From Linux-VServer

Jump to: navigation, search
(Setting POSIX capabilities (bcaps))
m (Reverted edits by Marc hamelin (Talk) to last revision by Gebura)
Line 42: Line 42:
 
  SETUID
 
  SETUID
 
  NET_BIND_SERVICE
 
  NET_BIND_SERVICE
NET_RAW
 
 
  SYS_CHROOT
 
  SYS_CHROOT
 
  SYS_PTRACE
 
  SYS_PTRACE
Line 49: Line 48:
 
  LEASE
 
  LEASE
 
  AUDIT_WRITE
 
  AUDIT_WRITE
 
''NET_RAW'' use for pcap (ex: tcpdump or snort software).
 
  
 
=== Setting network capabilities (ncaps) ===
 
=== Setting network capabilities (ncaps) ===

Revision as of 09:37, 3 October 2011

This page discusses how to set capabilities and flags for a util-vserver guest. Also check http://www.nongnu.org/util-vserver/doc/conf/configuration.html for additional information. A couple of general rules applies to all of the files described on this page:

  • The filenames are all relative to the guest's configuration directory, which typically is /etc/vservers/<guest> but by default /usr/local/etc/vservers/<guest> when built from source.
  • One capability/flag per line
  • To remove something set by default, prefix it with ~, for instance:
echo ~SET_UTSNAME >> ccapabilities
  • Comments can be added with #:
echo \# Disable utsname configuration >> ccapabilities
  • To set a specific bit which does not yet have a name in util-vserver, you can use the following notation to set bit 6:
echo ^6 >> ncapabilities

Contents

Setting context capabilities (ccaps)

  • Add the capabilities to a file named ccapabilities:
echo SYSLOG >> ccapabilities
  • The default ccaps are:
SET_UTSNAME
RAW_ICMP

Setting context flags (cflags)

  • Add the flags to a file named flags:
echo VIRT_MEM >> flags
  • The default cflags are (in addition to the defaults set by the kernel):
HIDE_NETIF

Setting network flags (nflags)

  • Add the flags to a file named nflags:
echo HIDE_NETIF >> nflags
  • The default nflags are:
HIDE_NETIF

Setting POSIX capabilities (bcaps)

  • Add the capabilities to a file named bcapabilities:
echo CHOWN >> bcapabilities
  • The default bcaps are:
CHOWN
DAC_OVERRIDE
DAC_READ_SEARCH
FOWNER
FSETID
KILL
SETGID
SETUID
NET_BIND_SERVICE
SYS_CHROOT
SYS_PTRACE
SYS_BOOT
SYS_TTY_CONFIG
LEASE
AUDIT_WRITE

Setting network capabilities (ncaps)

  • Add the capabilities to a file named ncapabilities:
echo ^12 >> ncapabilities
  • There are no default ncaps.

Modify flags without restarting the vservers

If you would like to edit those flags without restarting the vservers, you can use vattribute and nattribute. See util-vserver:Cheatsheet

Personal tools