kvm-guest in jail
Jens Kasten <[email protected]>
| Newsgroups | gmane.linux.rsbac |
|---|---|
| Message-ID | <1295190750.6778.8.camel@jaschtschik-pc> |
Hi list, I try to run a kvm-guest in a jail. My network setup for is bridged. The monitor option when I use tcp socket instead unix socket is available on the host. For monitor I would prefer to use the unix socket. But then I get: Sun Jan 16 14:34:27 2011 :<7>0000000864|rsbac_adf_request_jail(): process jail is 35, no allow_ipc and partner process unknown -> NOT_GRANTED! Sun Jan 16 14:34:27 2011 :<6>0000000865|rsbac_adf_request(): request ACCEPT, pid 9624, ppid 1, prog_name debian, prog_file /usr/bin/qemu-system-x86_64, uid 0, remote ip 192.168.1.5, target_type UNIXSOCK, tid Device 253:24 Inode 55284 Path /var/run/kvm/debian.socket, attr sock_type, value STREAM, result NOT_GRANTED by JAIL For network setup adding the iface to the bridge does not work. If really all fail I could use routing for guests. This command I use to start a guest: /usr/local/bin/rsbac_jail -I 0.0.0.0 -d -D -K -E -C NET_RAW DAC_OVERRIDE DAC_READ_SEARCH NET_ADMIN -M network sysctl /usr/bin/kvm-admin debian boot And this shows the logfile: Sun Jan 16 16:00:22 2011 :<6>0000001178|rsbac_adf_request(): request MODIFY_SYSTEM_DATA, pid 16483, ppid 16482, prog_name brctl, prog_file /sbin/brctl, uid 0, remote ip 127.0.0.1, target_type NETDEV, tid local, attr none, value none, result NOT_GRANTED by JAIL Grüsse Jens _______________________________________________ rsbac mailing list [email protected] http://www.rsbac.org/mailman/listinfo/rsbac