Re: [vserver] grsec change propositions

From: Jan Pobrislo <ccx_at_webprojekty.cz>
Date: Thu 17 Jun 2010 - 16:05:51 BST
Message-Id: <201006171706.07482.ccx@webprojekty.cz>

On Thursday 17 June 2010 16:53:41 Rik Bobbaers wrote:
> 3 possibilities:
> 1. disable ALL chroot restrictions when vserver kernel is enabled
> 2. disable the 4 restrictions and leave the choice for the rest of the
> chroot restrictions
> 3. SCREW IT, I'm a grown boy, i decide what i want, this is a free country
> (wether or not you live in one ;))

I would like to have number 2.

> anyway, I personally would disable all chroot restrictions, since security
> on the guests is primarily enforced by vserver code itself.

It is not always optimal to create separate vserver for each service and some
applications do their own chrooting (rsync, pure-ftp comes to mind). So not
all chrooting on vserver-enabled system is done by vserver itself and some
might need some additional hardening. But I'm in favor of kicking the ones
that break vserver.

Received on Thu Jun 17 16:12:33 2010
[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Thu 17 Jun 2010 - 16:12:37 BST by hypermail 2.1.8