We currently migrate to MediaWiki from our old installation, but not all content has been migrated yet. Take a look at the Wiki Team page for instructions how to help or browse through our new wiki at wiki.linux-vserver.org to find the information already migrated.

14. Step by Step Examples

The following examples can be reproduced on recent Linux systems without any modifications.

14.0. [E01] Linux Caps Example

 # grep Cap /proc/self/status

   CapInh: 0000000000000000
   CapPrm: 00000000fffffeff
   CapEff: 00000000fffffeff

14.1. [E02] Manipulating Linux Caps

 # lcap -z
 # grep Cap /proc/self/status

   CapInh: 0000000000000000
   CapPrm: 0000000000000000
   CapEff: 0000000000000000

14.2. [E03] CAP_MKNOD Example

 # lcap -z CAP_MKNOD
 # mknod /tmp/null b 0 0

   mknod: /tmp/null: Operation not permitted

14.3. [E11] Resource Limits via BASH

 bash-2.05# ulimit -H -a

   core file size (blocks)     unlimited
   data seg size (kbytes)      unlimited
   file size (blocks)          unlimited
   max locked memory (kbytes)  unlimited
   max memory size (kbytes)    unlimited
   open files                  1024
   pipe size (512 bytes)       8
   stack size (kbytes)         unlimited
   cpu time (seconds)          unlimited
   max user processes          256
   virtual memory (kbytes)     unlimited

14.4. [E12] Example CPU Time Limit

 bash-2.05# ulimit -t 10
 bash-2.05# /tmp/cpuhog

   Killed

14.5. [E13] Normal File without Attributes

 # touch /tmp/file
 # lsattr /tmp/file

   ------------- /tmp/file

 # rm -f /tmp/file

14.6. [E14] Immutable File Attribute

 # touch /tmp/file
 # chattr +i /tmp/file
 # lsattr /tmp/file

   ----i-------- /tmp/file

 # rm -f /tmp/file

   rm: unable to remove `/tmp/file': Operation not permitted

 # chattr -i /tmp/file
 # rm -f /tmp/file

14.7. [E15] Chroot Example

 # mkdir /tmp/root
 # mkdir /tmp/root/bin /tmp/root/lib
 # cp -a /lib/* /tmp/root/lib/
 # cp -a /bin/bash /tmp/root/bin/
 # cp -a /bin/ls /tmp/root/bin/

 # chroot /tmp/root /bin/bash

 bash-2.05# ls /

 bin  lib

The now following examples require a Linux-VServer kernel and recent util-vserver tools.

14.8. [E21] Process Isolation

 # chcontext ps auxw

   New security context is 49152
   USER       PID %CPU %MEM   VSZ  RSS TTY      STAT START   TIME COMMAND
   root        37 11.5  1.7  2408  500 tts/0    R    02:36   0:00 ps auxw

14.9. [E22] Dual Context Isolation

 # chcontext --ctx 100 sleep 111 &
 # chcontext --ctx 200 sleep 222 &
 # chcontext --ctx 100 ps auxw

   New security context is 100
   USER       PID %CPU %MEM   VSZ  RSS TTY      STAT START   TIME COMMAND
   root        23  0.3  1.5  2748  436 tts/0    S    18:47   0:00 sleep 111
   root        26 28.0  2.2  2476  664 tts/0    R    18:48   0:00 ps auxw

14.10. [E23] Fake Init Process

 # chcontext --flag fakeinit ps auxw

   New security context is 49153
   USER       PID %CPU %MEM   VSZ  RSS TTY      STAT START   TIME COMMAND
   root         1  0.0  0.4  2756  552 ?        S    19:09   0:04 init

14.11. [E24] Network Isolation

 # ifconfig lo 127.0.0.1
 # ifconfig eth0 10.0.0.2
 # ping -c 1 10.0.0.1

   PING 10.0.0.1 (10.0.0.1) from 10.0.0.2 : 56(84) bytes of data.
   64 bytes from 10.0.0.1: icmp_seq=0 ttl=64 time=4.814 msec

 # chbind --ip 127.0.0.1 ping -c 1 10.0.0.1

   ipv4root is now 127.0.0.1
   connect: Invalid argument

14.12. [E31] Context File Tagging

 # mount -o tagxid /dev/hd1/part1 /mnt/
 # mkdir /mnt/test
 # touch /mnt/test/file
 # lsctx /mnt/test/file

   #0   /mnt/test/file

 # chcontext --ctx 100 touch /mnt/test/file_100
 # lsctx -R /mnt/test

   #0   /mnt/test/file
   #100 /mnt/test/file_100

14.13. [E32] XID File Permissions

 # mount -o tagxid /dev/hd1/part1 /mnt/
 # chcontext --ctx 100 mkdir /mnt/100

   New security context is 100
 # chcontext --ctx 200 touch /mnt/100/file

   New security context is 200
   touch: /mnt/100/file: Permission denied

14.14. [E33] Context Flags

 # chcontext --flag ^24 cat /proc/mounts
   New security context is 49154

14.15. [E34] Context Capabilities

 # chcontext --flag ^24 cat /proc/mounts
   New security context is 49154

14.16. [E41] Context Accounting

 # cat /proc/virtual/1001/cacct

   UNSPEC:        0/0                 0/0                  0/0
   UNIX:         25/1626             25/1626               0/0
   INET:         12/531              48/1653              55/1625
   INET6:         0/0                 0/0                  0/0
   OTHER:         0/0                 0/0                  0/0

14.17. [E42] Context Limits

 # cat /proc/virtual/1001/limit

   PROC:         17             22             -1           0
   VM:        14290          16502          17000           5
   VML:           0              0             -1           0
   RSS:        5455           7816             -1           0
   FILES:       144            171             -1           0
   OFD:        -569           -541             -1           0

14.18. [E43] Uptime Virtualization

 # uptime

   20:31:11 up 21 min, load average: 0.20, 0.05, 0.01

 # chcontext --ctx 100 --flag ^17 bash -c "sleep 100; uptime"

   New security context is 100
   20:33:13 up 1 min, load average: 0.02, 0.03, 0.00

14.19. [E44] ProcFS Guest Security

 # setattr --hide /proc/*
 # chcontext --ctx 100 ls /proc

   New security context is 100
   527  self

14.20. [E45] ProcFS Host Security

 # setattr --hide --~admin /proc/*
 # ls /proc

   1  10  12  13  16  2  3  4  5  532  6  7  8  9   self

Linux-VServer-Paper-14 (2003.12.07 05:01:09)