--- /dev/null
+// $Id$ --*- c -*--
+
+// Copyright (C) 2004 Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de>
+//
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with this program; if not, write to the Free Software
+// Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+
+
+#ifdef HAVE_CONFIG_H
+# include <config.h>
+#endif
+
+#include "vserver.h"
+#include "assert.h"
+
+bool
+vc_isSupported(vcFeatureSet feature)
+{
+ int ver = vc_get_version();
+ if (ver==-1) return false;
+
+ switch (feature) {
+ case vcFEATURE_COMPAT : return true;
+ case vcFEATURE_VKILL : return ver >= 0x00010004;
+ case vcFEATURE_RLIMIT : return ver >= 0x00010004;
+ case vcFEATURE_VINFO : return ver >= 0x00010010;
+ case vcFEATURE_VHI : return ver >= 0x00010010;
+ case vcFEATURE_IATTR : return ver >= 0x00010011;
+ case vcFEATURE_MIGRATE : return ver >= 0x00010012;
+ case vcFEATURE_NAMESPACE : return ver >= 0x00010012;
+ case vcFEATURE_SCHED : return ver >= 0x00020000; // todo
+ default : assert(false);
+ }
+
+ return false;
+}
--- /dev/null
+#! /bin/bash
+# $Id$
+
+# Copyright (C) 2004 Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; version 2 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+
+: ${UTIL_VSERVER_VARS:=/usr/lib/util-vserver/util-vserver-vars}
+test -e "$UTIL_VSERVER_VARS" || {
+ echo "Can not find util-vserver installation; aborting..."
+ exit 1
+}
+. "$UTIL_VSERVER_VARS"
+. "$_LIB_FUNCTIONS"
+
+function showHelp()
+{
+ echo \
+$"Usage: /usr/sbin/chcontext [--cap [!]<cap_name>] [--secure] [--ctx <num>] [--disconnect]
+ [--domainname <name>] [--hostname <name>] [--flag <flags>+]
+ [--silent] [--] command arguments ...
+
+chcontext allocate a new security context and executes
+a command in that context.
+By default, a new/unused context is allocated
+
+--cap CAP_NAME
+ Add a capability from the command. This option may be
+ repeated several time.
+ See /usr/include/linux/capability.h
+ In general, this option is used with the --secure option
+ --secure removes most critical capabilities and --cap
+ adds specific ones.
+
+--cap !CAP_NAME
+ Remove a capability from the command. This option may be
+ repeated several time.
+ See /usr/include/linux/capability.h
+
+--ctx num
+ Select the context. On root in context 0 is allowed to
+ select a specific context.
+ Context number 1 is special. It can see all processes
+ in any contexts, but can't kill them though.
+ Option --ctx may be repeated several times to specify up to 16 contexts.
+--disconnect
+ Start the command in background and make the process
+ a child of process 1.
+--domainname new_domainname
+ Set the domainname (NIS) in the new security context.
+ Use "none" to unset the domain name.
+--flag
+ Set one flag in the new or current security context. The following
+ flags are supported. The option may be used several time.
+
+ fakeinit: The new process will believe it is process number 1.
+ Useful to run a real /sbin/init in a vserver.
+ lock: The new process is trapped and can't use chcontext anymore.
+ sched: The new process and its children will share a common
+ execution priority.
+ nproc: Limit the number of process in the vserver according to
+ ulimit setting. Normally, ulimit is a per user thing.
+ With this flag, it becomes a per vserver thing.
+ private: No one can join this security context once created.
+ ulimit: Apply the current ulimit to the whole context
+--hostname new_hostname
+ Set the hostname in the new security context
+ This is need because if you create a less privileged
+ security context, it may be unable to change its hostname
+--secure
+ Remove all the capabilities to make a virtual server trustable
+--silent
+ Do not print the allocated context number.
+
+Report bugs to <$PACKAGE_BUGREPORT>."
+ exit $1
+}
+
+function showVersion()
+{
+ echo \
+$"chcontext $PACKAGE_VERSION -- allocates/enters a security context
+This program is part of $PACKAGE_STRING
+
+Copyright (C) 2003 Enrico Scholz
+This program is free software; you may redistribute it under the terms of
+the GNU General Public License. This program has absolutely no warranty."
+ exit $1
+}
+
+isKernelAPI 0x00010012 || exec $_CHCONTEXT_COMPAT "$@"