Re: [vserver] Patch for 2.6.38.4 vserver + GR Security

From: Rik Bobbaers <rik_at_enzoverder.be>
Date: Wed 11 May 2011 - 15:14:59 BST
Message-ID: <27931.193.178.209.212.1305123299.squirrel@www.enzoverder.be>

that is an option as well off course :)

I'll see if i can spin patches like that if ever i find the time for it
(sorry all...)

KR

Rik Bobbaers

-- http://harry.enzoverder.be

> On Wed, May 11, 2011 at 02:07:53PM +0200, Rik Bobbaers wrote:
>
>> your patch won't work for a lot of instances...
>
>> one of the most important errors you made, is not changing the
>> atomic values, used by vserver to unchecked atomic values.
>> Bertl uses those counters so that they can (and are supposed
>> to) overflow. Therefore you have to change them to "unchecked"
>> atomics. You will get REFCOUNT overflow bugs in your kernel
>> (and corresponding panics).
>
>> So please... read my "vserver+grsec howto" from a couple of
>> months ago before taking this project on yourself ;)
>
> in general, I'd suggest to do patches _against_ a Linux-VServer
> patched kernel and not combination patches, as it simplifies
> the process of updating to newer Linux-VServer and kernel
> versions ...
>
> best,
> Herbert
>
>> read this thread first:
>> http://archives.linux-vserver.org/201011/0001.html
>
>> KR
>
>> Rik Bobbaers
>
>> -- http://harry.enzoverder.be
>
>>> http://sandino.araico.net/parches/vserver/patch-2.6.38.4-vs2.3
>>> .0.37-rc15-grsec-2.2.2-201104232142-KB1.diff
>
>>> -- Sandino Araico Sánchez http://sandino.net
>
Received on Wed May 11 15:15:11 2011

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Wed 11 May 2011 - 15:15:11 BST by hypermail 2.1.8