About this list Date view Thread view Subject view Author view Attachment view

From: Herbert Poetzl (herbert_at_13thfloor.at)
Date: Fri 01 Apr 2005 - 21:18:58 BST


On Fri, Apr 01, 2005 at 07:31:07PM +0200, Oliver Welter wrote:
> Hi Herbert,
>
> >>>hmm - so I think I have to mod the sources as I cant find appropriate
> >>>kernel config params...
> >
> >check for security modules and capabilities in particular
> >
> Can you tell me what I must look for ?
> If you mean "kernel" modules - i have a monolithic one - so no modules
> are loaded at all....

CONFIG_SECURITY=y
CONFIG_SECURITY_CAPABILITIES=y

or

CONFIG_SECURITY=n

both will use the capabilities compiled in ...

> >>So, that's not, what I think... I encountered the same problem, but on the
> >>"normal" kernels 2.6.8/9/10. The solve was to 'modprobe capabilities' or
> >>'modprobe realtime'. But if ntpd runs in the "main" context, I think, it
> >>is not
> >
> >this diagnosis sounds very accurate to me ...
> >I would double check if capabilities are loaded/compiled in
> >
> >maybe you are in deep trouble and do not even know it ;)
>
> as we use vserver only for process separeratin due to better maintenance
> it will not affect operational security - but good hint anyway....

it will, it will. trust me ...
most checks in linux-vserver kernel code are
based on linux capabilities, so they are a
requirement, not some kind of addon/feature ...

best,
Herbert

> Oliver
> --
> Diese Nachricht wurde digital unterschrieben
> oliwel's public key: http://www.oliwel.de/oliwel.crt
> Basiszertifikat: http://www.ldv.ei.tum.de/page72

> _______________________________________________
> Vserver mailing list
> Vserver_at_list.linux-vserver.org
> http://list.linux-vserver.org/mailman/listinfo/vserver

_______________________________________________
Vserver mailing list
Vserver_at_list.linux-vserver.org
http://list.linux-vserver.org/mailman/listinfo/vserver


About this list Date view Thread view Subject view Author view Attachment view
[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Fri 01 Apr 2005 - 21:19:17 BST by hypermail 2.1.3