2009/8/25 Serge E. Hallyn <span dir="ltr"><<a href="mailto:serue@us.ibm.com">serue@us.ibm.com</a>></span><br><div class="gmail_quote"><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div class="im">Quoting Daniel Lezcano (<a href="mailto:daniel.lezcano@free.fr">daniel.lezcano@free.fr</a>):<br>
> Krzysztof Taraszka wrote:<br>
>> Hi,<br>
>><br>
>> I was looking for possibility to secure lxc container to do not allow 'root<br>
>> container user' from changing limits from cgroup. Right now without STACK64<br>
>> or SELinux he can do this easily.<br>
>> I read the <a href="http://www.ibm.com/developerworks/linux/library/l-lxc-security/cookbook" target="_blank">http://www.ibm.com/developerworks/linux/library/l-lxc-security/cookbook</a><br>
>> and decided to use STACK64 kernel mechanism.<br>
>> Well... mounting cgroup inside container fails (great!, i am looked for that<br>
>> ;)) but networking fails too (interface bring up, sshd bring up, connection<br>
>> beetween host and container is, but 'mtr', 'ping' even 'apt-get update'<br>
>> fails and I do not know why). I secure my container exactly like in the<br>
>> cookbook.<br>
<br>
</div>Yeah, smack's use of cipso can make things tricky, and it's possible things<br>
have changed a bit recently. Although I'm currently running smack in my<br>
everyday s390 kernel to test checkpointing of its labels, and networking<br>
is working fine. </blockquote><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><br>
Can you give me a few details - what distro, smack policy, and precise kernel<br>
version are you using, for starters?<br>
<div class="im"></div></blockquote><div><br>debian lenny amd64,<br>kernel 2.6.30.5<br>lxc-tools from git<br><br>lxc1amd64:~# cat /etc/smackaccesses<br>debian _ rwa<br>_ debian rwa<br>_ host rwax<br>host _ rwax<br><br>where "debian" is container, "host" is a host.<br>
<br>I did this:<br><br>for f in `find /root/rootfs.debian`; do<br> attr -S -s SMACK64 -V debian $f<br>done<br><br>on the container fs.<br><br>container startup script look like here:<br><br>lxc1amd64:~# cat vs1.sh <br>
#!/bin/sh<br>cp /bin/dropmacadmin /root/rootfs.debian/bin/<br>attr -S -s SMACK64 -V debian /root/rootfs.debian/bin/dropmacadmin<br>echo debian > /proc/self/attr/current<br>lxc-start -n debian /bin/dropmacadmin /sbin/init<br>
<br>/etc/fstab inside container look like:<br><br>debian:~# cat /etc/fstab <br>tmpfs /dev/shm tmpfs defaults,smackfsroot=debian,smackfsdef=debian 0 0<br><br>And here is some output when I tried to do ping to the wp.pl, tried to apt-get update and tried to ping gateway<br>
<br>debian:~# ping wp.pl<br>PING wp.pl (212.77.100.101) 56(84) bytes of data.<br>From 10.177.128.1 icmp_seq=1 Parameter problem: pointer = 20<br>From 10.177.128.1 icmp_seq=2 Parameter problem: pointer = 20<br>^C<br>--- wp.pl ping statistics ---<br>
2 packets transmitted, 0 received, +2 errors, 100% packet loss, time 1001ms<br><br>debian:~# apt-get update<br>Err <a href="http://ftp.debian.org">http://ftp.debian.org</a> lenny Release.gpg<br> Could not connect to <a href="http://ftp.debian.org:80">ftp.debian.org:80</a> (130.89.149.226). - connect (71 Protocol error)<br>
Err <a href="http://ftp.debian.org">http://ftp.debian.org</a> lenny/main Translation-en_US<br> Could not connect to <a href="http://ftp.debian.org:80">ftp.debian.org:80</a> (130.89.149.226). - connect (71 Protocol error)<br>
Ign <a href="http://ftp.debian.org">http://ftp.debian.org</a> lenny Release<br>Ign <a href="http://ftp.debian.org">http://ftp.debian.org</a> lenny/main Packages/DiffIndex<br>Ign <a href="http://ftp.debian.org">http://ftp.debian.org</a> lenny/main Packages<br>
Err <a href="http://ftp.debian.org">http://ftp.debian.org</a> lenny/main Packages<br> Could not connect to <a href="http://ftp.debian.org:80">ftp.debian.org:80</a> (130.89.149.226). - connect (71 Protocol error)<br>W: Failed to fetch <a href="http://ftp.debian.org/debian/dists/lenny/Release.gpg">http://ftp.debian.org/debian/dists/lenny/Release.gpg</a> Could not connect to <a href="http://ftp.debian.org:80">ftp.debian.org:80</a> (130.89.149.226). - connect (71 Protocol error)<br>
<br>W: Failed to fetch <a href="http://ftp.debian.org/debian/dists/lenny/main/i18n/Translation-en_US.gz">http://ftp.debian.org/debian/dists/lenny/main/i18n/Translation-en_US.gz</a> Could not connect to <a href="http://ftp.debian.org:80">ftp.debian.org:80</a> (130.89.149.226). - connect (71 Protocol error)<br>
<br>W: Failed to fetch <a href="http://ftp.debian.org/debian/dists/lenny/main/binary-amd64/Packages">http://ftp.debian.org/debian/dists/lenny/main/binary-amd64/Packages</a> Could not connect to <a href="http://ftp.debian.org:80">ftp.debian.org:80</a> (130.89.149.226). - connect (71 Protocol error)<br>
<br>E: Some index files failed to download, they have been ignored, or old ones used instead.<br>debian:~# ping 192.168.1.1<br>PING 192.168.1.1 (192.168.1.1) 56(84) bytes of data.<br>64 bytes from <a href="http://192.168.1.1">192.168.1.1</a>: icmp_seq=1 ttl=64 time=0.085 ms<br>
unknown option 86<br>64 bytes from <a href="http://192.168.1.1">192.168.1.1</a>: icmp_seq=2 ttl=64 time=0.136 ms<br>unknown option 86<br>64 bytes from <a href="http://192.168.1.1">192.168.1.1</a>: icmp_seq=3 ttl=64 time=0.116 ms<br>
unknown option 86<br>^C<br>--- 192.168.1.1 ping statistics ---<br>3 packets transmitted, 3 received, 0% packet loss, time 2005ms<br>rtt min/avg/max/mdev = 0.085/0.112/0.136/0.022 ms<br><br>did you changed your smack policy or you have the same as mine?<br>
<br></div>-- <br>Krzysztof Taraszka<br></div>