We currently migrate to MediaWiki from our old installation, but not all content has been migrated yet. Take a look at the Wiki Team page for instructions how to help or browse through our new wiki at wiki.linux-vserver.org to find the information already migrated.

chroot-barrier

What is it?

As you might know, the default chroot implementation in Linux is not secure, there are well known ways to break out of a chroot. As the vservers reside in directories below the host system's root, we need a way to make sure that they cannot break out of their area, i.e. that they can't reach the host's or other vservers' areas. To achieve this, linux-vserver uses a marking known as the barrier.

How does it work?

really depends on the version, but basically it ensures that the vserver guest root can not pass a certain 'marked' directory with chroot().

the barrier either consists of a combination of certain attributes (i.e. flags and modes) or of a special flag, which is protected against modification from inside a vserver.

if you need more details, visit #vserver on OFTC and ask ...

How to use it?

Depends on which version of linux-vserver you're using.

<vserver-base-directory> is the directory in which the actual roots of your vservers are
(e.g. /vservers)

but for mounting/namespace/whatever reasons, it's better to specify it indirectly via <path-to-vserver>/..
(e.g. /vservers/myserver/..)

1.26+ (1.25 breaks some distros)

chmod 0000 <vserver-base-directory>

chattr +t <vserver-base-directory>

Warning for 1.26(1.25): The +t attribute is inherited and you won't be able to modify files and directories that have this flag set. Recent version ot util-vserver care about this, but older ones simply do not know about this and you'll have to remove the flag yourself.

1.27

the unwanted inheritance was fixed in the kernel patch

1.29.1

the barrier security was lowered to allow for sequences like:

cd /tmp; mkdir foo; mkdir foo/bar
chmod 0000 foo; chmod 0000 foo/bar

so make sure that the barrier conditions (i.e. chmod 000 and chattr +t) are met.

1.37+

similar to 1.9.x ...

1.9.x

the barrier has become a separate flag, which can be set with recent tools

setattr --barrier <vserver-base-directory>