[vserver] grsec change propositions

From: Rik Bobbaers <rik_at_enzoverder.be>
Date: Thu 17 Jun 2010 - 15:53:41 BST
Message-ID: <54969.85.91.175.222.1276786421.squirrel@www.enzoverder.be>

Heya all,

As Bertl isn't a real fan of the vserver+grsec merge since it's easy to
run into problems when you don't properly configure stuff.

SO, a proposition:
vserver is largely based on chroot and lots of options related to that.
The grsecurity part has a famous "chroot restrictions" list. Some options
need to be disabled to make vservers work properly. Right now, leave the
choice to the user to config it, but it causes problems when you "just
enable all"

3 possibilities:
1. disable ALL chroot restrictions when vserver kernel is enabled
2. disable the 4 restrictions and leave the choice for the rest of the
chroot restrictions
3. SCREW IT, I'm a grown boy, i decide what i want, this is a free country
(wether or not you live in one ;))

anyway, I personally would disable all chroot restrictions, since security
on the guests is primarily enforced by vserver code itself. The second
option has more options for the user (do you want that?)
The third option is maybe not optimal since noobs will run into problems.

Are there more requests on "better integration" of grsecurity and
linux-vserver?

ps. i'm not an expert in the linux-vserver code nor the grsecurity/pax
code, so don't ask me to completely rewrite any of the 2! ;)

Bertl: you're the leader of the linux-vserver, so your suggestions weigh
more in discussions! I want you to "enjoy" having a vserver+grsecurity
patch instead of resenting it.

anyway: let the discussions run wild!!! ;)

Rik Bobbaers

-- http://harry.enzoverder.be
linux/unix/system/network/security/hardware admin
infrastructure architect
Received on Thu Jun 17 15:57:23 2010

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Thu 17 Jun 2010 - 15:57:26 BST by hypermail 2.1.8