Re: [vserver] Patch for vserver + GR Security

From: Herbert Poetzl <>
Date: Wed 11 May 2011 - 14:07:10 BST
Message-ID: <>

On Wed, May 11, 2011 at 02:07:53PM +0200, Rik Bobbaers wrote:

> your patch won't work for a lot of instances...

> one of the most important errors you made, is not changing the
> atomic values, used by vserver to unchecked atomic values.
> Bertl uses those counters so that they can (and are supposed
> to) overflow. Therefore you have to change them to "unchecked"
> atomics. You will get REFCOUNT overflow bugs in your kernel
> (and corresponding panics).

> So please... read my "vserver+grsec howto" from a couple of
> months ago before taking this project on yourself ;)

in general, I'd suggest to do patches _against_ a Linux-VServer
patched kernel and not combination patches, as it simplifies
the process of updating to newer Linux-VServer and kernel
versions ...


> read this thread first:

> KR

> Rik Bobbaers

> --

>> .0.37-rc15-grsec-2.2.2-201104232142-KB1.diff

>> -- Sandino Araico Sánchez
Received on Wed May 11 14:07:27 2011

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Wed 11 May 2011 - 14:07:27 BST by hypermail 2.1.8