On Mon, Dec 20, 2010 at 05:19:42PM +0000, Ed W wrote:
> Curiously enough - vserver + grsec would have apparently prevented the
> root escalation in the first place (if only because of limiting access
> to kallsyms?).
I'm using the Bristol wireless kernels from the repo
deb http://repo.psand.net/ lenny main
(incidentally, after having installed two systems with
2.6.36-vs2.3.0.36.38-beng today, are these safe to use
in production, or should I go back to
2.6.31.14-vs2.3.0.36.28.2-beng ?) which don't come
with grsec+pax (or whatever de rigeur is these days).
Are there any prepackaged debian kernels with grsec patch
out there? I'm not aware of any, and I'd hate to roll
my own. Does one need to define a policy to go with
it, for that matter? This is always a problem with SELinux,
the stock policy is largely useless, and without a
carefully manually crafted one SELinux is a point of
breakage ("just turn it off, and 90% of problems will
go away").
> Kernel level root escalations are quite scary in a virtualised
> environment - it would be interesting to get an idea from Herbert about
Indeed, especially if one wants to run hundreds of guests/machine for
semianonymous, possibly hostile users. Even with remote
take-off-and-nuke-from-orbit-via-IPMI and reinstall guests
from backup is a) still annoying b) will have you compromised
in a second, if you or your users invoke compromised binaries
from the archive.
> whether that level of kernel escalation allows the rooted user to escape
> from the vserver jail, and whether there is anything further that can be
> done to limit that in practice?
I would be very interested in grsec etc. patched kernels.
I would be even willing to build these and test them, provided
somebody writes down a good recipe for how to apply patches
and roll Debian packages from these which are as functional
as those from the Bristol Wireless repo.
-- Eugen* Leitl leitl http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BEReceived on Mon Dec 20 18:18:30 2010