Re: [vserver] grsec change propositions

From: Rik Bobbaers <rik_at_enzoverder.be>
Date: Mon 21 Jun 2010 - 14:47:22 BST
Message-ID: <51135.85.91.175.222.1277128042.squirrel@www.enzoverder.be>

> probably it is not good way to block GRKERNSEC_CHROOT_FINDTASK and
> GRKERNSEC_CHROOT_DOUBLE cos someone (me) does not use/need/allow chroot
> in chroot

true, but as soon as someone uses e.g. vsftpd or so with a chroot option
or anything
else they might not know it uses chroot, their programs won't work anymore
with
those options enabled. So I think it's generally a good sollution to keep
those 2
disabled anyway. Also because you're protected by the use of
namespaces/contexts for
these kind of attacks. (unless there's a bug in those ones aswell)

But if most of the people here would like to see it enable-able again, let
me know!
I'll change it again!

Greetings,

Rik Bobbaers

-- http://harry.enzoverder.be
linux/unix/system/network/security/hardware admin
infrastructure architect
Received on Mon Jun 21 14:55:24 2010

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Mon 21 Jun 2010 - 14:55:27 BST by hypermail 2.1.8