Re: [vserver] [Grsec] audit denies pivot_root ?

From: Romain Riviere <romain.riviere_at_gmail.com>
Date: Mon 22 Nov 2010 - 19:42:49 GMT
Message-Id: <8333FE2B-CFCB-4036-AFBA-526B466F5F90@gmail.com>

Hello,

Le 22 nov. 2010 à 12:28, Rik Bobbaers a écrit :

> don't really know what you mean by this but: is your problem solved now?
> or are there still problems?
There are still problems.

> the audit parameters shouldn't normally stop the pivot_root call... they
> might LOG things, but not block.
And yet they do, along with logging.

> the chroot_deny_pivot does effectively
> block the pivot_root call.
Oddly enough it does not, meaning I can perfectly start my guest with chroot_deny_pivot=1 ...

> BTW. this is why i wouldn't really use chroot restrictions in combination
> with vserver. Bertl has done a lot of work to secure his vserver
> implementation. This makes grsecurity extras useless/abundant in
> combination with vserver... (just my 2 cents)

True. I am usually more interested in the PaX features, but during testing, this behaviour striked me as odd ... as you said, *audit* should not block anything, yet it does, and this is quite unnerving.
Anything I can do to help investigate ?

Cheers,

Romain
Received on Mon Nov 22 19:43:57 2010

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Mon 22 Nov 2010 - 19:43:58 GMT by hypermail 2.1.8