Re: [vserver] Patch for 2.6.38.4 vserver + GR Security

From: Herbert Poetzl <herbert_at_13thfloor.at>
Date: Wed 11 May 2011 - 14:07:10 BST
Message-ID: <20110511130710.GD25946@MAIL.13thfloor.at>

On Wed, May 11, 2011 at 02:07:53PM +0200, Rik Bobbaers wrote:

> your patch won't work for a lot of instances...

> one of the most important errors you made, is not changing the
> atomic values, used by vserver to unchecked atomic values.
> Bertl uses those counters so that they can (and are supposed
> to) overflow. Therefore you have to change them to "unchecked"
> atomics. You will get REFCOUNT overflow bugs in your kernel
> (and corresponding panics).

> So please... read my "vserver+grsec howto" from a couple of
> months ago before taking this project on yourself ;)

in general, I'd suggest to do patches _against_ a Linux-VServer
patched kernel and not combination patches, as it simplifies
the process of updating to newer Linux-VServer and kernel
versions ...

best,
Herbert

> read this thread first:
> http://archives.linux-vserver.org/201011/0001.html

> KR

> Rik Bobbaers

> -- http://harry.enzoverder.be

>> http://sandino.araico.net/parches/vserver/patch-2.6.38.4-vs2.3
>> .0.37-rc15-grsec-2.2.2-201104232142-KB1.diff

>> -- Sandino Araico Sánchez http://sandino.net
Received on Wed May 11 14:07:27 2011

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Wed 11 May 2011 - 14:07:27 BST by hypermail 2.1.8