From: Enrico Scholz Date: Fri, 27 Feb 2004 18:00:37 +0000 (+0000) Subject: initial checkin X-Git-Tag: VERSION_0_10~534 X-Git-Url: http://git.linux-vserver.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=72d0916cacc395fa33d53a7d5f24b352c375a917;p=util-vserver.git initial checkin git-svn-id: http://svn.linux-vserver.org/svn/util-vserver/trunk@1032 94cd875c-1c1d-0410-91d2-eb244daf1a30 --- diff --git a/util-vserver/lib/issupported.c b/util-vserver/lib/issupported.c new file mode 100644 index 0000000..5984bc3 --- /dev/null +++ b/util-vserver/lib/issupported.c @@ -0,0 +1,46 @@ +// $Id$ --*- c -*-- + +// Copyright (C) 2004 Enrico Scholz +// +// This program is free software; you can redistribute it and/or modify +// it under the terms of the GNU General Public License as published by +// the Free Software Foundation; version 2 of the License. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU General Public License for more details. +// +// You should have received a copy of the GNU General Public License +// along with this program; if not, write to the Free Software +// Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. + + +#ifdef HAVE_CONFIG_H +# include +#endif + +#include "vserver.h" +#include "assert.h" + +bool +vc_isSupported(vcFeatureSet feature) +{ + int ver = vc_get_version(); + if (ver==-1) return false; + + switch (feature) { + case vcFEATURE_COMPAT : return true; + case vcFEATURE_VKILL : return ver >= 0x00010004; + case vcFEATURE_RLIMIT : return ver >= 0x00010004; + case vcFEATURE_VINFO : return ver >= 0x00010010; + case vcFEATURE_VHI : return ver >= 0x00010010; + case vcFEATURE_IATTR : return ver >= 0x00010011; + case vcFEATURE_MIGRATE : return ver >= 0x00010012; + case vcFEATURE_NAMESPACE : return ver >= 0x00010012; + case vcFEATURE_SCHED : return ver >= 0x00020000; // todo + default : assert(false); + } + + return false; +} diff --git a/util-vserver/scripts/chcontext b/util-vserver/scripts/chcontext new file mode 100755 index 0000000..69f644c --- /dev/null +++ b/util-vserver/scripts/chcontext @@ -0,0 +1,102 @@ +#! /bin/bash +# $Id$ + +# Copyright (C) 2004 Enrico Scholz +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; version 2 of the License. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. + +: ${UTIL_VSERVER_VARS:=/usr/lib/util-vserver/util-vserver-vars} +test -e "$UTIL_VSERVER_VARS" || { + echo "Can not find util-vserver installation; aborting..." + exit 1 +} +. "$UTIL_VSERVER_VARS" +. "$_LIB_FUNCTIONS" + +function showHelp() +{ + echo \ +$"Usage: /usr/sbin/chcontext [--cap [!]] [--secure] [--ctx ] [--disconnect] + [--domainname ] [--hostname ] [--flag +] + [--silent] [--] command arguments ... + +chcontext allocate a new security context and executes +a command in that context. +By default, a new/unused context is allocated + +--cap CAP_NAME + Add a capability from the command. This option may be + repeated several time. + See /usr/include/linux/capability.h + In general, this option is used with the --secure option + --secure removes most critical capabilities and --cap + adds specific ones. + +--cap !CAP_NAME + Remove a capability from the command. This option may be + repeated several time. + See /usr/include/linux/capability.h + +--ctx num + Select the context. On root in context 0 is allowed to + select a specific context. + Context number 1 is special. It can see all processes + in any contexts, but can't kill them though. + Option --ctx may be repeated several times to specify up to 16 contexts. +--disconnect + Start the command in background and make the process + a child of process 1. +--domainname new_domainname + Set the domainname (NIS) in the new security context. + Use "none" to unset the domain name. +--flag + Set one flag in the new or current security context. The following + flags are supported. The option may be used several time. + + fakeinit: The new process will believe it is process number 1. + Useful to run a real /sbin/init in a vserver. + lock: The new process is trapped and can't use chcontext anymore. + sched: The new process and its children will share a common + execution priority. + nproc: Limit the number of process in the vserver according to + ulimit setting. Normally, ulimit is a per user thing. + With this flag, it becomes a per vserver thing. + private: No one can join this security context once created. + ulimit: Apply the current ulimit to the whole context +--hostname new_hostname + Set the hostname in the new security context + This is need because if you create a less privileged + security context, it may be unable to change its hostname +--secure + Remove all the capabilities to make a virtual server trustable +--silent + Do not print the allocated context number. + +Report bugs to <$PACKAGE_BUGREPORT>." + exit $1 +} + +function showVersion() +{ + echo \ +$"chcontext $PACKAGE_VERSION -- allocates/enters a security context +This program is part of $PACKAGE_STRING + +Copyright (C) 2003 Enrico Scholz +This program is free software; you may redistribute it under the terms of +the GNU General Public License. This program has absolutely no warranty." + exit $1 +} + +isKernelAPI 0x00010012 || exec $_CHCONTEXT_COMPAT "$@"