Re: [vserver] Patch for 2.6.38.4 vserver + GR Security

I found this message in the list archives:

On 08/11/10 07:02, Rik Bobbaers wrote:
> grep for "unchecked" in the kernel/verver subdirectory (of a vserver+grsec
> patch that i made before)...

I dedicated little time to merging this patch but seems that I will need
to pay deeper attention to these atomic definitions you mention to have
the server processes working for more than 5 minutes.

I don't have much time but I need a working 2.6.38 kernel so I will keep
trying to fix it.

On 11/05/11 07:07, Rik Bobbaers wrote:
> your patch won't work for a lot of instances...
>
> one of the most important errors you made, is not changing the atomic
> values, used by vserver to unchecked atomic values. Bertl uses those
> counters so that they can (and are supposed to) overflow. Therefore you
> have to change them to "unchecked" atomics.
> You will get REFCOUNT overflow bugs in your kernel (and corresponding
> panics).
>
> So please... read my "vserver+grsec howto" from a couple of months ago
> before taking this project on yourself ;)
>
> read this thread first:
> http://archives.linux-vserver.org/201011/0001.html
>
> KR
>
> Rik Bobbaers
>
> -- http://harry.enzoverder.be
>
>> http://sandino.araico.net/parches/vserver/patch-2.6.38.4-vs2.3.0.37-rc15-grsec-2.2.2-201104232142-KB1.diff
>>
>> --
>> Sandino Araico Sánchez
>> http://sandino.net
>>
>>

-- 
Sandino Araico Sánchez
http://sandino.net