Quagga in VE - Revision history

Kir: use proper template in a proper way

2009-10-19T08:59:04Z

use proper template in a proper way

Kir: formatting fixes

2009-10-19T08:58:20Z

formatting fixes

203.45.127.186 at 00:28, 18 October 2009

2009-10-18T00:28:00Z

203.45.127.186 at 00:27, 18 October 2009

2009-10-18T00:27:16Z

203.45.127.186: New page: Quagga inside a VE requires 3 Linux capabilities configured for the container on the hostnode: vzctl set 24 --capability net_admin:on --save vzctl set 24 --capability net_raw:on --save ...

2009-10-18T00:26:56Z

New page: Quagga inside a VE requires 3 Linux capabilities configured for the container on the hostnode: vzctl set 24 --capability net_admin:on --save vzctl set 24 --capability net_raw:on --save ...

New page

Quagga inside a VE requires 3 Linux capabilities configured for the container on the hostnode:

vzctl set 24 --capability net_admin:on --save
vzctl set 24 --capability net_raw:on --save
vzctl set 24 --capability sys_admin:on --save

When they are not configured, you'll see the following symptoms when starting up zebra:

# zebra
privs_init: initial cap_set_proc failed

And when stracing:

# strace zebra
[..]
capset(0x19980330, 0, {CAP_NET_ADMIN|CAP_NET_RAW|CAP_SYS_ADMIN, CAP_NET_ADMIN|CAP_NET_RAW|CAP_SYS_ADMIN, 0}) = -1 EPERM (Operation not permitted)
write(2, "privs_init: initial cap_set_proc"..., 40privs_init: initial cap_set_proc failed
) = 40
exit_group(1) = ?

Note: granting capabilities for a container can have reduced security implications - ensure you fully understand the repercussions of granting any of the above capabilities before using in production.

[[Category: Networking]]

@@ Line 19: / Line 19: @@
   exit_group(1)                           = ?
-{{Note: granting capabilities for a container can have reduced security implications - ensure you fully understand the repercussions of granting any of the above capabilities before using in production.}}
+{{Warning|granting capabilities for a container can have reduced security implications - ensure you fully understand the repercussions of granting any of the above capabilities before using in production.}}
 [[Category: Networking]]

@@ Line 1: / Line 1: @@
-Quagga inside a VE requires 3 Linux capabilities configured for the container on the hostnode:
+Quagga inside a CT requires 3 Linux capabilities configured for the container on the host node:
-  vzctl set <id> --capability net_admin:on --save
+  vzctl set CTID --capability net_admin:on --save
-  vzctl set <id> --capability net_raw:on --save
+  vzctl set CTID --capability net_raw:on --save
-  vzctl set <id> --capability sys_admin:on --save
+  vzctl set CTID --capability sys_admin:on --save
 When they are not configured, you'll see the following symptoms when starting up zebra:
@@ Line 19: / Line 19: @@
   exit_group(1)                           = ?
-[[Note: granting capabilities for a container can have reduced security implications - ensure you fully understand the repercussions of granting any of the above capabilities before using in production.]]
+{{Note: granting capabilities for a container can have reduced security implications - ensure you fully understand the repercussions of granting any of the above capabilities before using in production.}}
 [[Category: Networking]]