Hi,
I have been thinking lately of the grsecury patch. There are many
features in grsecurity that is redundant or does not really work very
well with vserver.
Does RBAC really work in a vserver? Can you set up policies for each
vserver? I doubt it and if not, the RBAC is pretty useless.
grsecurity also provides some features to prevent escaping from a
chroot. A vserver is a chroot and has its own mechanism to prevent
escaping. So I think the additiona features provided in grsecurity
should be added to vserver if they are needed.
So whats left in grsecurity? The extra logging. Not very useful for
vservers (logs be very easily flooded)
So whats left is basicly Pax which makes really sense to have. There is
a separate patch for PaX only which is updated more often than the full
grsecurity patch.
Might be an idea to combine vserver+pax rather than vserver+grsecurity?
-nc
Received on Thu Feb 14 09:10:38 2008