We currently migrate to MediaWiki from our old installation, but not all content has been migrated yet. Take a look at the Wiki Team page for instructions how to help or browse through our new wiki at wiki.linux-vserver.org to find the information already migrated.

The Linux-VServer project provides a mechanism to protect entries in the proc filesystem from being seen in every context, this has been introduced in development release 1.3.5 and stable release 1.23.

The system consists of three flags: admin, watch and hide. To view/set these, a recent version of the util-vserver package, containing setattr and showattr, is required. (There is another tool called vproc, but this won't be discussed here). The logic behind these flags has been changed in experimental release 0.09, and new devel / stable releases that also use this logic, are coming soon, so the old logic won't be explained here (if you're running an older version of Linux-VServer, you probably already figured it out yourself anyways).

Note:

When reffering to the flags, i'll follow the syntax used by the showattr tool of the util-vserver package, where a means admin, w means watch and h means hide, also lower case means disabled and upper case means enabled.

Flag logic (Linux-VServer 2.4 branch > 1.3.7 / 2.6 branch > 0.08)

The flags have the following meanings:

Flag Meaning
admin always visible in context 0
watch always visible in context 1
hide hidden

This means a mapping of flagging to visibility according to this table:

Flags Visibility
* * h Visible everwhere (admin and watch flags don't matter)
A w H Visible only in context 0
a W H Visible only in context 1
A W H Visible in contexts 0 and 1
a w H Totally invisible (cannot be reverted without rebooting!)

Default flagging

As of now stable defaults to all proc entries visible everywhere, development and experimental versions default to all proc entries only visible in context 0.

Setting flags

To set those flags you'll need the setattr tool from a recent util-vserver package, the usage is pretty much self-explanatory from the command-line help. To make the /proc/loadavg entry visible everywhere, you have to unset the hide flag:

setattr --~hide /proc/loadavg

The admin and watch flag can be in any state as hiding is controlled by the hide flag only.

To keep vservers from reading the interrupt information, you need to hide the /proc/interrupts entry. If you want this to be accessible in the admin context (0) only use:

setattr --hide --admin --~watch /proc/interrupts

vprocunhide

With alpha util-vserver comes a tool called vprocunhide that sets reasonable flags for a number of proc entries that are generally needed to be visible. There is also an init script, normally located at /usr/local/etc/init.d/vprocunhide that you can use to include it in your boot process.