Can't initialize iptables table filter and nat: Permission denied

The best solution will be to change the container image to have an updated iptables version, but in case you can't do that, follow the next steps.

Environment

• Red Hat OpenShift Container Platform 4.6+

Issue

Executing iptables command in an application container fails with the following error.

 

[root@pod]# iptables -L iptables v1.8.4 (legacy): can't initialize iptables table `filter': Permission denied Perhaps iptables or your kernel needs to be upgraded.

[root@pod]# iptables -L -t nat iptables v1.8.4 (legacy): can't initialize iptables table `nat': Permission denied Perhaps iptables or your kernel needs to be upgraded.

Resolution

Add the needed capabilities and match the SELinux denied context on audit logs on pod.spec.containers[0].securityContext.

spec: containers: securityContext: privileged: false capabilities: drop: ["all"] add: ["NET_ADMIN", "NET_RAW", "NET_BIND_SERVICE"] seLinuxOptions: user: "system_u" role: "system_r" type: "container_t" level: "s0:c981,c991"

Diagnostic Steps

1. Find the worker node from where the pod is running.
2. Connect to the worker node.
3. Tail audit log.
4. Initialize a bash session on the pod.
5. Execute iptables command.
6. Wait for iptables denial error on audit log.

[root@worker] # tail -f /var/logs/audit/audit.log ...[ SNIP ]... type=AVC msg=audit(1618591176.860:2303): avc: denied { module_request } for pid=912615 comm="iptables" kmod="iptable_filter" scontext=system_u:system_r:container_t:s0:c981,c991 tcontext=system_u:system_r:kernel_t:s0 tclass=system permissive=0 type=AVC msg=audit(1618591176.860:2304): avc: denied { module_request } for pid=912615 comm="iptables" kmod="iptable_filter" scontext=system_u:system_r:container_t:s0:c981,c991 tcontext=system_u:system_r:kernel_t:s0 tclass=system permissive=0 ...[ SNIP ]...

GRSecurity + Java = Killed + Headup = Running App

 When we work with hardened kernels and tools like grsecurity and PaX, we face problems like:

1. The kernel kills applications.
2. Some applications can not start.
3. We can't compile applications.
4. And many others.....

This problem depends on the security level configured in the kernel. We need to configure and tell the system that some blocked applications are reliable and trusted, this is because some legitimate applications will attempt to generate code at run time which is executed out of memory. PaX does not allow this and will promptly kill the offending application.

The most notable of these applications are XFree/Xorg, mplayer, and multimedia tools based on xine-lib and Java virtual machine.

homero / # java -version
Killed

homero / # uname -a
Linux homero 2.6.27.15-grsec-2.1.12-vs2.3.0.36.4 #11 SMP Fri Mar 25 17:30:38 CST 2011 i686 Intel(R) Xeon(TM) CPU 3.20GHz GenuineIntel GNU/Linux

homero ~ # tail -f /var/log/pax.log 
Aug  8 13:06:23 homero kernel: [7748633.853670] PAX: From X.X.X.X: execution attempt in: , 48f7f000-48fa7000 48f7f000
Aug  8 13:06:23 homero kernel: [7748633.853683] PAX: terminating task: /usr/local/jdk1.6.0_26/bin/java(java):18549, uid/euid: 0/0, PC: 48f7f040, SP: 4b05dddc
Aug  8 13:06:23 homero kernel: [7748633.853695] PAX: bytes at PC: f0 83 04 24 00 8b 44 24 0c c3 00 00 00 00 00 00 00 00 00 00 
Aug  8 13:06:23 homero kernel: [7748633.853718] PAX: bytes at SP-4:

homero bin # pwd
/usr/local/jdk1.6.0_26/bin

To solve this problem we need to work with some PaX utils and applications, such as paxctl and chpax, in order to change the rules of security but only with some applications.

homero bin # emerge pax-utils pax paxctl paxtest -pv
These are the packages that would be merged, in order:

Calculating dependencies... done!
[ebuild   R    ] sys-apps/paxctl-0.5  0 kB
[ebuild   R    ] app-misc/pax-utils-0.2.2  USE="caps" 0 kB
[ebuild   R    ] app-arch/pax-3.3.4  0 kB
[ebuild   R   ~] app-admin/paxtest-0.9.9-r2  0 kB

Total: 4 packages (4 reinstalls), Size of downloads: 0 kB

 * IMPORTANT: 4 news items need reading for repository 'gentoo'.
 * Use eselect news to read news items.

First, we need to create the PT_PAX_FLAGS

homero bin # paxctl -C *
file ControlPanel is not a valid ELF executable
file HtmlConverter is not a valid ELF executable
file appletviewer got a new PT_PAX_FLAGS program header
file apt got a new PT_PAX_FLAGS program header
file extcheck got a new PT_PAX_FLAGS program header
file idlj got a new PT_PAX_FLAGS program header
file jar got a new PT_PAX_FLAGS program header
file jarsigner got a new PT_PAX_FLAGS program header
file java got a new PT_PAX_FLAGS program header
file java-rmi.cgi is not a valid ELF executable
file javac got a new PT_PAX_FLAGS program header
file javadoc got a new PT_PAX_FLAGS program header
file javah got a new PT_PAX_FLAGS program header
file javap got a new PT_PAX_FLAGS program header
file javaws got a new PT_PAX_FLAGS program header
file jconsole got a new PT_PAX_FLAGS program header
file jcontrol is not a valid ELF executable
file jdb got a new PT_PAX_FLAGS program header
file jhat got a new PT_PAX_FLAGS program header
file jinfo got a new PT_PAX_FLAGS program header
file jmap got a new PT_PAX_FLAGS program header
file jps got a new PT_PAX_FLAGS program header
file jrunscript got a new PT_PAX_FLAGS program header
file jsadebugd got a new PT_PAX_FLAGS program header
file jstack got a new PT_PAX_FLAGS program header
file jstat got a new PT_PAX_FLAGS program header
file jstatd got a new PT_PAX_FLAGS program header
file jvisualvm is not a valid ELF executable
file keytool got a new PT_PAX_FLAGS program header
file native2ascii got a new PT_PAX_FLAGS program header
file orbd got a new PT_PAX_FLAGS program header
file pack200 got a new PT_PAX_FLAGS program header
file policytool got a new PT_PAX_FLAGS program header
file rmic got a new PT_PAX_FLAGS program header
file rmid got a new PT_PAX_FLAGS program header
file rmiregistry got a new PT_PAX_FLAGS program header
file schemagen got a new PT_PAX_FLAGS program header
file serialver got a new PT_PAX_FLAGS program header
file servertool got a new PT_PAX_FLAGS program header
file tnameserv got a new PT_PAX_FLAGS program header
file unpack200 got a new PT_PAX_FLAGS program header
file wsgen got a new PT_PAX_FLAGS program header
file wsimport got a new PT_PAX_FLAGS program header
file xjc got a new PT_PAX_FLAGS program header

homero bin # paxctl -v java
PaX control v0.5
Copyright 2004,2005,2006,2007 PaX Team 

- PaX flags: -------x-e-- [java]
    RANDEXEC is disabled
    EMUTRAMP is disabled

The problem is the mprotect flag, because it is enabled.

Name

mprotect - control allowable accesses to a region of memory

Synopsis
#include 
int mprotect(const void *addr, size_t len, int prot);

Description
The function mprotect() specifies the desired protection for the memory page(s) containing part or all of the interval [addr,addr+len-1]. If an access is disallowed by the protection given it, the program receives a SIGSEGV. 

The goal of MPROTECT is to help prevent the introduction of new executable code into the task’s address space. This is accomplished by restricting the mmap() and mprotect() interfaces.

The restrictions prevent:
     - Creating executable anonymous mappings.
     - Creating executable/writable file mappings.
     - Making an executable/read-only file mapping writable except for performing relocations on an ET_DYN ELF file (non-PIC shared library).
     - Making a non-executable mapping executable.

So we need to disable it.

homero bin # paxctl -m *
file ControlPanel is not a valid ELF executable
file HtmlConverter is not a valid ELF executable
file java-rmi.cgi is not a valid ELF executable
file jcontrol is not a valid ELF executable
file jvisualvm is not a valid ELF executable

homero bin # paxctl -v java
PaX control v0.5
Copyright 2004,2005,2006,2007 PaX Team 

- PaX flags: -----m-x-e-- [java]
    MPROTECT is disabled
    RANDEXEC is disabled
    EMUTRAMP is disabled

homero bin # java -version
java version "1.6.0_26"
Java(TM) SE Runtime Environment (build 1.6.0_26-b03)
Java HotSpot(TM) Client VM (build 20.1-b02, mixed mode)

And now we can run any java application on our hardened system.

DotDotPwn-2.1 Gentoo ebuild

DotDotPwn - The Directory Traversal Fuzzer.
It's a very flexible intelligent fuzzer to discover traversal directory vulnerabilities in software such as Web/FTP/TFTP servers, and Web platforms such as CMSs, ERPs, Blogs, etc. Also, it has a protocol-independent module to send the desired payload to the host and port specified. On the other hand, it also could be used in a scripting way using the STDOUT module. It's written in Perl programming language and can be run either under *NIX or Windows platforms.

Official Site: dotdotpwn
Download Link: **From Chatsubo (IN)Security Dark Labs Mirror **
Official E-mail: dotdotpwn@sectester.net

Last version:
DotDotPwn v2.1
Release date: 29/Oct/2010 (PUBLIC Release at BugCon Security Conferences 2010)
Release date: 14/Oct/2010 *NON-PUBLIC Version*

DEPRECATED HOW TO, CLICK HERE FOR THE LAST VERSION EBUILD ON PENTOO GITHUB

Preparing the portage tree, more info HERE:

evo ~ # mkdir -p /usr/local/portage/profiles/
evo ~ # echo "Headup Overlay" > /usr/local/portage/profiles/repo_name 
evo ~ # mkdir -p /usr/local/portage/net-analyzer/dotdotpwn/
evo ~ # echo "PORTDIR_OVERLAY=/usr/local/portage" >> /etc/make.conf
evo ~ # cd /usr/local/portage/net-analyzer/dotdotpwn/
evo dotdotpwn #  wget http://headup.sytes.net/zbox/pkfiles/dotdotpwn-2.1.ebuild
evo dotdotpwn # ebuild dotdotpwn-2.1.ebuild manifest
>>> Downloading 'http://www.brainoverflow.org/code/dotdotpwn-v2.1.tar.gz'
--2011-09-27 13:51:42--  http://www.brainoverflow.org/code/dotdotpwn-v2.1.tar.gz
Resolving www.brainoverflow.org (www.brainoverflow.org)... 75.125.156.234
Connecting to www.brainoverflow.org (www.brainoverflow.org)|75.125.156.234|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 27478 (27K) [application/x-gzip]
Saving to: `/usr/portage/distfiles/dotdotpwn-v2.1.tar.gz'

100%[==================================================================>] 27,478      33.3K/s   in 0.8s

2011-09-27 13:51:44 (33.3 KB/s) - `/usr/portage/distfiles/dotdotpwn-v2.1.tar.gz' saved [27478/27478]

>>> Creating Manifest for /usr/local/portage/net-analyzer/dotdotpwn

Look the files

evo dotdotpwn # ll
total 8
-rw-r--r-- 1 root root  398 Sep 27 13:51 Manifest
-rw-r--r-- 1 root root 1478 Sep 27 13:51 dotdotpwn-2.1.ebuild

Searching in our portage tree and portdir overlay:

evo dotdotpwn # emerge dotdotpwn -s
Searching...
[ Results for search key : dotdotpwn ]
[ Applications found : 1 ]

*  net-analyzer/dotdotpwn [ Masked ]
      Latest version available: 2.1
      Latest version installed: [ Not Installed ]
      Size of files: 26 kB
      Homepage:      http://dotdotpwn.blogspot.com
      Description:   The Directory Traversal Fuzzer.
      License:       GPL-3

Preparing and making our system consistent (good practice):

evo dotdotpwn # echo net-analyzer/dotdotpwn ~x86 >> /etc/portage/package.keywords
evo dotdotpwn # echo net-analyzer/dotdotpwn os-detection >> /etc/portage/package.use
evo dotdotpwn # echo perl-core/Switch ~x86 >> /etc/portage/package.keywords
evo dotdotpwn # emerge dotdotpwn -pv

These are the packages that would be merged, in order:

Calculating dependencies... done!
[ebuild  N    ~] perl-core/Switch-2.160.0  14 kB [0]
[ebuild  N     ] net-analyzer/nmap-5.51  USE="ssl -gtk -lua" 16,474 kB [0]
[ebuild  N     ] perl-core/Time-HiRes-1.97.19  86 kB [0]
[ebuild  N     ] dev-perl/Log-Agent-0.307.0  54 kB [0]
[ebuild  N     ] dev-perl/yaml-0.71  111 kB [0]
[ebuild  N     ] app-portage/g-cpan-0.16.2  28 kB [0]
[ebuild  N    ~] net-analyzer/dotdotpwn-2.1  USE="os-detection" 0 kB [1]

Total: 7 packages (7 new), Size of downloads: 16,765 kB
Portage tree and overlays:
 [0] /usr/portage
 [1] /usr/local/portage

 * IMPORTANT: 4 news items need reading for repository 'gentoo'.
 * Use eselect news to read news items.

And now, we are good to go.... merging....!!!!!!

evo dotdotpwn # emerge dotdotpwn

.......
.......
.......

>>> Emerging (7 of 7) net-analyzer/dotdotpwn-2.1 from Headup-Overlay
 * dotdotpwn-v2.1.tar.gz RMD160 SHA1 SHA256 size ;-) ...                                                                                                                                             [ ok ]

........
........

If you don't have CPAN installed, you will see a lot of lines with CPAN and CPAN Modules installation.... 
Do not worry, just hit enter in every question....

........
........

>>> Unpacking source...

........
........

>>> Install dotdotpwn-2.1 into /var/tmp/portage/net-analyzer/dotdotpwn-2.1/image/ category net-analyzer
>>> Completed installing dotdotpwn-2.1 into /var/tmp/portage/net-analyzer/dotdotpwn-2.1/image/


>>> Installing (7 of 7) net-analyzer/dotdotpwn-2.1

........
........

>>> Recording net-analyzer/dotdotpwn in "world" favorites file.

........
........


 * Messages for package net-analyzer/dotdotpwn-2.1:

 * Package:    net-analyzer/dotdotpwn-2.1
 * Repository: Headup-Overlay
 * USE:        elibc_glibc kernel_linux os-detection userland_GNU x86
 * FEATURES:   preserve-libs sandbox userpriv usersandbox
 * Package:    net-analyzer/dotdotpwn-2.1
 * Repository: Headup-Overlay
 * USE:        elibc_glibc kernel_linux os-detection userland_GNU x86
 * FEATURES:   preserve-libs sandbox userpriv usersandbox
 * nothing to compile
 * Removing /usr/share/info
>>> Auto-cleaning packages...

>>> No outdated packages were found on your system.

 * IMPORTANT: 4 news items need reading for repository 'gentoo'.
 * Use eselect news to read news items.

And now everything is in place, libs and files.

evo dotdotpwn # cd
evo ~ # ll /etc/dotdotpwn/
total 64
-rw-r--r-- 1 root root   606 Sep 27 14:09 AUTHORS.txt
-rw-r--r-- 1 root root  3851 Sep 27 14:09 CHANGELOG.txt
-rw-r--r-- 1 root root  6671 Sep 27 14:09 EXAMPLES.txt
-rw-r--r-- 1 root root 35147 Sep 27 14:09 LICENSE.txt
-rw-r--r-- 1 root root  2490 Sep 27 14:09 README.txt
-rw-r--r-- 1 root root  2964 Sep 27 14:09 USAGE.txt
-rw-r--r-- 1 root root    85 Sep 27 14:09 payload_sample.txt
drwxr-xr-x 2 root root    48 Sep 27 14:09 retrieved_files
evo ~ # ll /usr/bin/dotdotpwn*
lrwxrwxrwx 1 root root   21 Sep 27 14:09 /usr/bin/dotdotpwn -> /usr/bin/dotdotpwn.pl
-rwxr-xr-x 1 root root 9135 Sep 27 14:09 /usr/bin/dotdotpwn.pl
evo ~ # ll `perl -e 'use strict; print map {"$INC{$_}"} keys %INC' | awk '{sub("strict.pm","") ; print }'`/DotDotPwn
total 44
-rw-r--r-- 1 root root 2235 Sep 27 04:32 FTP.pm
-rw-r--r-- 1 root root  796 Sep 27 04:32 File.pm
-rw-r--r-- 1 root root 2134 Sep 27 04:32 Fingerprint.pm
-rw-r--r-- 1 root root 1787 Sep 27 04:32 HTTP.pm
-rw-r--r-- 1 root root 1739 Sep 27 04:32 HTTP_Url.pm
-rw-r--r-- 1 root root 1818 Sep 27 04:32 Payload.pm
-rw-r--r-- 1 root root  527 Sep 27 04:32 STDOUT.pm
-rw-r--r-- 1 root root 2089 Sep 27 04:32 TFTP.pm
-rw-r--r-- 1 root root 9681 Sep 27 04:32 TraversalEngine.pm

And finally.... have fun!!!!!

Thanks to @nitr0usmx and @chr1x for giving us dotdotpwn, and like they said... Happy fuzzing! ;)

Hardened environment running GRSecurity and VMWare Server

After a common install of vmware-server...

vm-win ~ # emerge vmware-server -pv

These are the packages that would be merged, in order:

Calculating dependencies... done!
[ebuild   Rf  ] app-emulation/vmware-server-2.0.2.203138-r1  0 kB

Total: 1 package (1 reinstall), Size of downloads: 0 kB
Fetch Restriction: 1 package

 * IMPORTANT: 3 news items need reading for repository 'gentoo'.
 * Use eselect news to read news items.

... our vmware-server cannot start, to solve this problem we need to work with some PaX utils and applications, such as paxctl and chpax, in order to change the rules of security but only with some applications.

vm-win ~ # emerge pax-utils pax paxctl paxtest -pv
These are the packages that would be merged, in order:

Calculating dependencies... done!
[ebuild   R   ] sys-apps/paxctl-0.5  0 kB
[ebuild   R   ] app-misc/pax-utils-0.2.1  USE="caps" 0 kB
[ebuild   R   ] app-arch/pax-3.3.4  0 kB
[ebuild   R   ] app-admin/paxtest-0.9.9-r1  0 kB

Total: 4 packages (4 reinstalls), Size of downloads: 0 kB

 * IMPORTANT: 4 news items need reading for repository 'gentoo'.
 * Use eselect news to read news items.

Here are some options.

vm-win ~ # chpax --help
chpax 0.7 .::. Manage PaX flags for binaries
Usage: chpax OPTIONS FILE1 FILE2 FILEN ...
  -P	enforce paging based non-executable pages
  -p	do not enforce paging based non-executable pages
  -E	emulate trampolines
  -e	do not emulate trampolines
  -M	restrict mprotect()
  -m	do not restrict mprotect()
  -R	randomize mmap() base [ELF only]
  -r	do not randomize mmap() base [ELF only]
  -X	randomize ET_EXEC base [ELF only]
  -x	do not randomize ET_EXEC base [ELF only]
  -S	enforce segmentation based non-executable pages
  -s	do not enforce segmentation based non-executable pages
  -v	view current flag mask 
  -z	zero flag mask (next flags still apply)

The flags only have effect when running the patched Linux kernel.

vm-win ~ # paxctl -h

PaX control v0.5
Copyright 2004,2005,2006,2007 PaX Team 

usage: paxctl 

options:
	-p: disable PAGEEXEC		-P: enable PAGEEXEC
	-e: disable EMUTRMAP		-E: enable EMUTRMAP
	-m: disable MPROTECT		-M: enable MPROTECT
	-r: disable RANDMMAP		-R: enable RANDMMAP
	-x: disable RANDEXEC		-X: enable RANDEXEC
	-s: disable SEGMEXEC		-S: enable SEGMEXEC

	-v: view flags			-z: restore default flags
	-q: suppress error messages	-Q: report flags in short format
	-c: convert PT_GNU_STACK into PT_PAX_FLAGS (see manpage!)
	-C: create PT_PAX_FLAGS (see manpage!)

The next script will change the security policy rules of the vmware-server-2.0.2.
First the config and opts file.

vm-win ~ # cat /etc/conf.d/grsecurity

# /etc/conf.d/grsecurity

CHPAX_CMD="/sbin/chpax"
CHPAX_OPTIONS="-rsm"

PAXCTL_CMD="/sbin/paxctl"
PAXCTL_OPTIONS="-pemrxs"
PAXCTL_OPTIONS_="-z"
PAXCTL_CONVERT="-c"

Then the init script.

vm-win ~ # cat /etc/init.d/grsecurity

#!/sbin/runscript
# Copyright 1999-2010 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
# $Header: $

depend() {
	before vmware
}

start() {
	ebegin "Setting grsecurity rules and options"
	${PAXCTL_CMD} ${PAXCTL_CONVERT} /opt/vmware/server/lib/bin/vmware-hostd
	${PAXCTL_CMD} ${PAXCTL_OPTIONS} /opt/vmware/server/lib/bin/vmware-hostd

	${PAXCTL_CMD} ${PAXCTL_CONVERT} /opt/vmware/server/bin/vmnet-bridge
	${PAXCTL_CMD} ${PAXCTL_OPTIONS} /opt/vmware/server/bin/vmnet-bridge

	${PAXCTL_CMD} ${PAXCTL_CONVERT} /opt/vmware/server/lib/bin/vmware-vmx
	${PAXCTL_CMD} ${PAXCTL_OPTIONS} /opt/vmware/server/lib/bin/vmware-vmx
}

stop(){
	ebegin "Restoring default grsecurity rules and options"
	${PAXCTL_CMD} ${PAXCTL_CONVERT} /opt/vmware/server/lib/bin/vmware-hostd
        ${PAXCTL_CMD} ${PAXCTL_OPTIONS_} /opt/vmware/server/lib/bin/vmware-hostd

	${PAXCTL_CMD} ${PAXCTL_CONVERT} /opt/vmware/server/bin/vmnet-bridge
        ${PAXCTL_CMD} ${PAXCTL_OPTIONS_} /opt/vmware/server/bin/vmnet-bridge

	${PAXCTL_CMD} ${PAXCTL_CONVERT} /opt/vmware/server/lib/bin/vmware-vmx
        ${PAXCTL_CMD} ${PAXCTL_OPTIONS_} /opt/vmware/server/lib/bin/vmware-vmx
}

restart() {
	stop
	start
}

I know!!!!.... This is an ugly script, but it worked at a "Hardened Gentoo [server] " security level.

┌────────────────────────── Security Level ──────────────────────────┐                                                                  
│  Use the arrow keys to navigate this window or press the hotkey of │                                                                  
│  the item you wish to select followed by the . Press    │                                                                  
│  > for additional information about this option.                 │                                                                  
│ ┌────────────────────────────────────────────────────────────────┐ │                                                                  
│ │           ( ) Low                                              │ │                                                                  
│ │           ( ) Medium                                           │ │                                                                  
│ │           ( ) High                                             │ │                                                                  
│ │           (X) Hardened Gentoo [server]                         │ │                                                                  
│ │           ( ) Hardened Gentoo [server no rbac]                 │ │                                                                  
│ │           ( ) Hardened Gentoo [workstation]                    │ │                                                                  
│ └───────────────v(+)─────────────────────────────────────────────┘ │                                                                  
├────────────────────────────────────────────────────────────────────┤                                                                  
│                                                    │                                                                  
└────────────────────────────────────────────────────────────────────┘                                                                  

Runing kernel

vm-win ~ # uname -a

Linux vm-win 2.6.35-hardened #7 SMP Thu Sep 30 22:13:03 GMT 2010 x86_64 Intel(R) Xeon(R) CPU L5410 @ 2.33GHz GenuineIntel GNU/Linux

And now... all is running correctly.

vm-win ~ # ps ax

  PID TTY      STAT   TIME COMMAND
    1 ?        Ss     0:00 init [3]  

   ..........

 2010 ?        Ss     0:00 /usr/bin/svscan /service
 2038 ?        Ss     0:00 /usr/sbin/cron
 2125 ?        Ss     0:00 /opt/vmware/server/bin/vmnet-bridge -d /var/run/vmnet-bridge-0.pid -n 0 -i eth0
 2404 ?        Ss     0:00 /opt/vmware/server/sbin/vmware-authdlauncher
 2418 ?        S      0:00 /bin/sh /opt/vmware/server/bin/vmware-watchdog -s webAccess -u 30 -q 5 /opt/vmware/server/lib/webAccess/java/jre1.5.0_15/bin/webAccess -client -Xmx64m -XX:MinHeapFreeRatio=30 
 2441 ?        Ssl    0:29 /opt/vmware/server/lib/webAccess/java/jre1.5.0_15/bin/webAccess -client -Xmx64m -XX:MinHeapFreeRatio=30 -XX:MaxHeapFreeRatio=30 -Djava.util.logging.manager=org.apache.juli.Cla
 2523 ?        Ssl    0:21 /opt/vmware/server/lib/bin/vmware-hostd -a -d -u /etc/vmware/hostd/config.xml
 2576 ?        Ssl    9:31 /opt/vmware/server/lib/bin/vmware-vmx -# product=2;name=VMware Server;version=2.0.2;buildnumber=203138;licensename=VMware GSX Server for Linux;licenseversion=3.0 build-203138;
 2642 ?        Ssl    3:34 /opt/vmware/server/lib/bin/vmware-vmx -# product=2;name=VMware Server;version=2.0.2;buildnumber=203138;licensename=VMware GSX Server for Linux;licenseversion=3.0 build-203138;
 2676 ?        Ssl    3:48 /opt/vmware/server/lib/bin/vmware-vmx -# product=2;name=VMware Server;version=2.0.2;buildnumber=203138;licensename=VMware GSX Server for Linux;licenseversion=3.0 build-203138;