Re: [vserver] Can't see all my processes?

Ed W wrote:
> David Karban wrote:
>> Ed W napsal(a):
>>> Hi
>> Hi,
>> I had same issue with bind run in vserver in chroot jail with
>> grsecurity chroot jail protection. Bind process was visible from host
>> by vps, but not in guest. Without chroot jail protection was visible
>> in guest too.
>>
>> But the question is ... are you chrooting in vserver ?
>
> Aha, I'm not knowingly chrooting, but then this is a bit of bernstein
> software, so I guess that it quite probably does a chroot (dnscache)
>
> Any tips on adjusting grsec? I'm not sure really why the chroot
> protection would cause this effect? Presumably it's somehow causing the
> process security tags to change in some way?
>

It's GRKERNSEC_CHROOT_FINDTASK. It should be either disabled in kernel or
by kernel.grsecurity.chroot_findtask=0 sysctl.

config GRKERNSEC_CHROOT_FINDTASK
         bool "Protect outside processes"
         depends on GRKERNSEC_CHROOT
         help
           If you say Y here, processes inside a chroot will not be able to
           kill, send signals with fcntl, ptrace, capget, getpgid, getsid,
           or view any process outside of the chroot. If the sysctl
           option is enabled, a sysctl option with name "chroot_findtask" is
           created.

-- 
Regards,
Vitaly