Ed W wrote:
> David Karban wrote:
>> Ed W napsal(a):
>> I had same issue with bind run in vserver in chroot jail with
>> grsecurity chroot jail protection. Bind process was visible from host
>> by vps, but not in guest. Without chroot jail protection was visible
>> in guest too.
>> But the question is ... are you chrooting in vserver ?
> Aha, I'm not knowingly chrooting, but then this is a bit of bernstein
> software, so I guess that it quite probably does a chroot (dnscache)
> Any tips on adjusting grsec? I'm not sure really why the chroot
> protection would cause this effect? Presumably it's somehow causing the
> process security tags to change in some way?
It's GRKERNSEC_CHROOT_FINDTASK. It should be either disabled in kernel or
by kernel.grsecurity.chroot_findtask=0 sysctl.
bool "Protect outside processes"
depends on GRKERNSEC_CHROOT
If you say Y here, processes inside a chroot will not be able to
kill, send signals with fcntl, ptrace, capget, getpgid, getsid,
or view any process outside of the chroot. If the sysctl
option is enabled, a sysctl option with name "chroot_findtask" is
-- Regards, VitalyReceived on Tue May 13 16:04:04 2008