> probably it is not good way to block GRKERNSEC_CHROOT_FINDTASK and
> GRKERNSEC_CHROOT_DOUBLE cos someone (me) does not use/need/allow chroot
> in chroot
true, but as soon as someone uses e.g. vsftpd or so with a chroot option
or anything
else they might not know it uses chroot, their programs won't work anymore
with
those options enabled. So I think it's generally a good sollution to keep
those 2
disabled anyway. Also because you're protected by the use of
namespaces/contexts for
these kind of attacks. (unless there's a bug in those ones aswell)
But if most of the people here would like to see it enable-able again, let
me know!
I'll change it again!
Greetings,
Rik Bobbaers
-- http://harry.enzoverder.be
linux/unix/system/network/security/hardware admin
infrastructure architect
Received on Mon Jun 21 14:55:24 2010