We currently migrate to MediaWiki from our old installation, but not all content has been migrated yet. Take a look at the Wiki Team page for instructions how to help or browse through our new wiki at wiki.linux-vserver.org to find the information already migrated.

chroot-barrier

What is it?

As you might know, the default chroot implementation in Linux is not secure, there are well known ways to break out of a chroot. As the vservers reside in directories below the host system's root, we need a way to make sure that they cannot break out of their area, i.e. that they can't reach the host's or other vservers' areas. To achieve this, linux-vserver uses a flag known as the barrier flag.

How does it work?

Two choices:

a) Visit #vserver on OFTC, ask Bertl, the author of this document does not know the details.

b) Have a look at the code and figure it out yourself.

If you know about the details, please expand this document.

How to use it?

Depends on which version of linux-vserver you're using.

<vserver-base-directory> is the directory in which the actual roots of your vservers are, for example /vservers.

1.26+ (1.25 breaks some distros)

chmod 0000 <vserver-base-directory>

chattr +t <vserver-base-directory>

Warning for 1.26(1.25): The +t attribute is inherited and you won't be able to modify files and directories that have this flag set. Recent version ot util-vserver care about this, but older ones simply do not know about this and you'll have to remove the flag yourself.

1.37+