user-mode-linux-user

Re: [User-mode-linux-user] Re: [UNSTABLE] user-mode port 0.29-2.4.0-test6

[Jeff D. <jd...@ka...>]

> Is it now capable of bringing up the umn network device without having
> to  run as root? 

No, the umn device will always require some priviledged help.

The eth device can run without needing root because it doesn't necessarily 
need to configure a device in the host.  Instead, a daemon does routing.  So, 
if you just want an isolated virtual network, you can do that with the eth 
device because the host networking isn't involved.  However, if you want the 
host on that virtual net, or you want it to communicate with a physical 
ethernet, you're back to needing privs.

				Jeff

Re: [User-mode-linux-user] Re: [UNSTABLE] user-mode port 0.29-2.4.0-test6

[Jeff D. <jd...@ka...>]

> the UML itself needs root privileges to  set the ldisc to N_SLIP.

I never noticed that.  um_ifconfig works fine by itself for me.  If it hadn't, 
I definitely would have figured out why and fixed it :-)

So, what controls what permissions you need in order to set the line 
discipline?  I would have thought that ownership was enough.

				Jeff

Re: [User-mode-linux-user] Re: [UNSTABLE] user-mode port 0.29-2.4.0-test6

[David W. <dw...@re...>]

jd...@ka... said:
>  So, what controls what permissions you need in order to set the line
> discipline?  I would have thought that ownership was enough.

For most ldiscs, yes. Not SLIP, though.

static int
slip_open(struct tty_struct *tty)
{
        struct slip *sl;
        int err;

        if(!capable(CAP_NET_ADMIN))
                return -EPERM;

--
dwmw2

Re: [User-mode-linux-user] Re: [UNSTABLE] user-mode port 0.29-2.4.0-test6

[Jeff D. <jd...@ka...>]

dw...@re... said:
> For most ldiscs, yes. Not SLIP, though.
> static int slip_open(struct tty_struct *tty) {
>         struct slip *sl;
>         int err;
>         if(!capable(CAP_NET_ADMIN))
>                 return -EPERM; 

When did that happen?  My sources (2.2.5, RH 6.0 :-) don't have anything like 
that.  I guess that explains why I'm getting away with so much.

Maybe you shouldn't run such a secure OS :-)

So, your idea of passing the fd into the helper for setup seems like a good 
one.  The problem is that I'm planning on retiring the umn device in favor of 
the eth device at some point, so I don't exactly feel like putting time into 
it.  If someone else wants to, I'll merge the changes, though.

				Jeff

Re: [User-mode-linux-user] Re: [UNSTABLE] user-mode port 0.29-2.4.0-test6

[David W. <dw...@in...>]

On Mon, 14 Aug 2000, Jeff Dike wrote:

> dw...@re... said:
> > For most ldiscs, yes. Not SLIP, though.
> > static int slip_open(struct tty_struct *tty) {
> >         struct slip *sl;
> >         int err;
> >         if(!capable(CAP_NET_ADMIN))
> >                 return -EPERM; 
> 
> When did that happen?  My sources (2.2.5, RH 6.0 :-) don't have anything like 
> that.  I guess that explains why I'm getting away with so much.

My CVS tree says 2.2.13

> So, your idea of passing the fd into the helper for setup seems like a
> good one.  The problem is that I'm planning on retiring the umn device
> in favor of the eth device at some point, so I don't exactly feel like
> putting time into it.  If someone else wants to, I'll merge the
> changes, though.

I'll have a poke at it. I don't really want to play with ethertap on the
host.

-- 
dwmw2

Re: [User-mode-linux-user] Re: [UNSTABLE] user-mode port 0.29-2.4.0-test6

[David W. <dw...@re...>]

jd...@ka... said:
>  No, the umn device will always require some priviledged help. 

It can have privileged help. It's just that the suid um_ifconfig that it 
has at the moment isn't enough - the UML itself needs root privileges to 
set the ldisc to N_SLIP.

This can be fixed by opening a pty from the parent, and letting the suid
helper process inherit the fd - then the helper can both set the line
discipline and do the necessary ifconfig stuff.

--
dwmw2