On Thursday 17 June 2010 16:53:41 Rik Bobbaers wrote:
> 3 possibilities:
> 1. disable ALL chroot restrictions when vserver kernel is enabled
> 2. disable the 4 restrictions and leave the choice for the rest of the
> chroot restrictions
> 3. SCREW IT, I'm a grown boy, i decide what i want, this is a free country
> (wether or not you live in one ;))
I would like to have number 2.
> anyway, I personally would disable all chroot restrictions, since security
> on the guests is primarily enforced by vserver code itself.
It is not always optimal to create separate vserver for each service and some
applications do their own chrooting (rsync, pure-ftp comes to mind). So not
all chrooting on vserver-enabled system is done by vserver itself and some
might need some additional hardening. But I'm in favor of kicking the ones
that break vserver.