Re: [vserver] [Grsec] audit denies pivot_root ?

From: Rik Bobbaers <rik_at_enzoverder.be>
Date: Mon 22 Nov 2010 - 11:28:22 GMT
Message-ID: <57251.193.178.209.212.1290425302.squirrel@www.enzoverder.be>

don't really know what you mean by this but: is your problem solved now?
or are there still problems?

the audit parameters shouldn't normally stop the pivot_root call... they
might LOG things, but not block. the chroot_deny_pivot does effectively
block the pivot_root call.
BTW. this is why i wouldn't really use chroot restrictions in combination
with vserver. Bertl has done a lot of work to secure his vserver
implementation. This makes grsecurity extras useless/abundant in
combination with vserver... (just my 2 cents)

KR,

Rik Bobbaers

-- http://harry.enzoverder.be
linux/unix/system/network/security/hardware admin
infrastructure architect

> Hello,
>
> Le 19 nov. 2010 à 17:22, Romain Riviere a écrit :
>
>> Hello,
>>
>> Le 19 nov. 2010 à 16:54, Rik Bobbaers a écrit :
>>
>>>> The problem is that "vserver <name> start" fails with "vcontext:
>>>
>>> check this one...:
>>>
>>>> pivot_root(): Invalid argument"<snip>
>>> kernel.grsecurity.chroot_deny_pivot = 1
>>>
>>> looks quite obvious... :)
>>
>> It's not: the exact same behaviour is displayed when chroot_deny_pivot
>> is set to 0.
>
> Harry, just to confirm one thing, as I have been playing a lot with grsec
> flags. The following setup *ALWAYS* causes the pivot_root error:
> kernel.grsecurity.audit_mount=1
> kernel.grsecurity.audit_chdir=0
> kernel.grsecurity.chroot_deny_pivot=0
>
> Cheers,
> Romain
Received on Mon Nov 22 11:28:15 2010

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Mon 22 Nov 2010 - 11:28:17 GMT by hypermail 2.1.8