[vserver] Mini-Kernel (was: Zero day privilege escalation exploit for kernels 2.6.37=>3.8.10 (CVE-2013-2094))

From: Allan Latham <alatham_at_flexsys-group.de>
Date: Fri 17 May 2013 - 14:33:52 BST
Message-ID: <519631C0.8050605@flexsys-group.de>

Hi Ben

Many thanks for your efforts.

I use your util-veserver packages but I am still currently using the
Debian Squeeze vsserver kernel.

I intend to move away from this kernel during the next phase of the
testing I am doing - either to yours or I will roll my own. It's years
since I needed to compile the kernel and I see that Linux is now about
10 times the size!

One thought occurs to me and I would be interested in the opinions of
others.

Basis is a suitable computer (x86_64) at one of the many server farms
world wide:

1. The base kernel should come from whatever the server supplier
recommends. He knows it supports his hardware, network etc. e.g. a
minimal Squeeze or Wheezy installation will do fine.

2. On this kernel load the kvm modules. Besides supporting the
hardware,lvm and starting one or more kvms this bare-metal kernel does
nothing.

3. Run vservers inside kvm.

This means that the kernel for the vservers can be vastly simplified.
Most of the server configuration is devoted to hardware which disappears
inside the vm. It is a standardised environment.

Less is generally safer.

I know a kvm is less efficient than bare-metal but I don't really care.
The fact that I have an inner system which I can (near) instantly be
moved to any server supplier is worth far more.

What are your thoughts on such a 'standard mini-kernel' for use within a
kvm? I suspect it could even be built without modules.

All the best and once again thanks for all you're doing.

Allan

On 17/05/13 11:38, Ben Green wrote:
> Quoting Ben Green <ben@bristolwireless.net>:
>
>> I'm rebuilding now with the relevant patch in place, a simple 1 liner.
>> I'll upload to the Psand repos in the morning.
>
> Done, kernels now ready for download from the Psand repositories. Who'd
> have thought 3 characters in the whole of the kernels source code could
> cause such a fuss. Package and metapackage examples are as follows:
>
> Package: linux-image-vserver-3.2-beng
> Version: 3.2.44-2.3.2.16+squeeze1
>
> Package: linux-image-3.2.44-vs2.3.2.16-beng
> Source: linux-source-3.2.44-vs2.3.2.16-beng
> Version: 0.2+squeeze1
>
> Note particularly the version number.
>
> Cheers,
> Ben
>
>
>
>
Received on Fri May 17 14:34:04 2013

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Fri 17 May 2013 - 14:34:04 BST by hypermail 2.1.8