Editing
0001.html
(section)
From Linix VServer
Jump to navigation
Jump to search
Warning:
You are not logged in. Your IP address will be publicly visible if you make any edits. If you
log in
or
create an account
, your edits will be attributed to your username, along with other benefits.
Anti-spam check. Do
not
fill this in!
= [vserver] Vserver + grsec thoughts = * <span class="dfn">This message</span>: [ [[#start|Message body]] ] [ [[#options2|More options]] ] * <span class="dfn">Related messages</span>: [ [[0002.html|Next message]] ] [ [[0000.html|Previous message]] ] [ [[0005.html|Next in thread]] ] [ [[#replies|Replies]] ] </div> <div class="mail"> <span id="from"> <span class="dfn">From</span>: Ed W <[mailto:lists_at_wildgooses.com?Subject=Re:%20%5Bvserver%5D%20Vserver%20%2B%20grsec%20thoughts lists_at_wildgooses.com]> </span><br /> <span id="date"><span class="dfn">Date</span>: Wed 03 Nov 2010 - 17:48:05 GMT</span><br /> <span id="message-id"><span class="dfn">Message-ID</span>: <4CD1A055.8050100@wildgooses.com> </span><br /> Hi, there is a bunch of commentary about the grsec/pax patch recently, I<br /> asked around a little and just wanted to summarise some notes:<br /> - The most interesting part of the grsec patch seems to be the "PAX"<br /> part. This is mainly about making data pages non executable, but the<br /> patch size appears dominated by changes to "constifying" various parts<br /> of the kernel and catching dereference errors.<br /> - The PAX patch appears to apply cleanly against linux-vserver patches<br /> (Rik could you perhaps comment if there are hidden gotchas though?)<br /> - Apart from an RBAC system (which doesn't completely integrate with VS)<br /> the GRSEC patches mainly enhance logging, restrict /proc visibility and<br /> lock down chroot escapes - the later seems to be the main attractive<br /> item. However, discussing those restrictions with Herbert he suggests<br /> that possibly those restrictions are amply protected in VS already?<br /> Herberts comments below - I would appreciate thoughts from the audience:<br /> ''>> > CONFIG_GRKERNSEC_CHROOT_PIVOT=y''<br /> ''> sys_pivot_root() requires CAP_SYS_ADMIN''<br /> ''>''<br /> ''>> > CONFIG_GRKERNSEC_CHROOT_CHDIR=y''<br /> ''>> > CONFIG_GRKERNSEC_CHROOT_FCHDIR=y''<br /> ''> this is blocked (for the guest root) with''<br /> ''> barrier and pivot_root (with recent utils)''<br /> ''>''<br /> ''>> > CONFIG_GRKERNSEC_CHROOT_MKNOD=y''<br /> ''> sys_mknod() requires CAP_MKNOD''<br /> ''>''<br /> ''>> > CONFIG_GRKERNSEC_CHROOT_SHMAT=y''<br /> ''> a guest can only attach to shared memory''<br /> ''> inside the guest''<br /> ''>''<br /> ''>> > CONFIG_GRKERNSEC_CHROOT_UNIX=y''<br /> ''> same for abstract unix sockets''<br /> ''>''<br /> ''>> > # CONFIG_GRKERNSEC_CHROOT_NICE is not set''<br /> ''> guest have a priority offset and an''<br /> ''> upper bound for the priority inside''<br /> ''>''<br /> ''>> > CONFIG_GRKERNSEC_CHROOT_SYSCTL=y''<br /> ''> this requires euid = 0, which is not true''<br /> ''> inside any guest''<br /> ''>''<br /> So my question is really what the grsec patches add for the situation<br /> that the host is considered "secure" and we are interested only in<br /> locking down the guests. Assuming Herbert has understood the grsec<br /> chroot changes correctly then the interesting grsec additions appear to<br /> be: larger entropy pools, some better logging of mounts/segfaults, some<br /> small extra hardenings of /proc and probably some other things I forget<br /> writing this off the cuff? The grsec RBAC is complicated to use in a<br /> guest (does anyone at all use it?)<br /> If so then my thought is to use only the pax patch (and perhaps cherry<br /> pick some individual bits of grsec). This would seem to be easier to<br /> maintain and appears to keep 95% of the benefits? The pax guys seem to<br /> be extremely helpful and responsive to problems (just like<br /> linux-vserver), so it seems useful to be able to keep fairly up to date<br /> on both patch sets?<br /> Any thoughts? (I'm especially hoping to hear from Rik?)<br /> (Note: To those wondering why add Pax at all. For a hardened server<br /> installation it appears to have successfully mitigated most of the<br /> recent kernel bugs. If you are also compiling with -fstack-protector and<br /> PIE then it seems to make a large class of userspace attacks (buffer<br /> overflows in particular) fairly difficult.)<br /> Cheers<br /> Ed W<br /> <span id="received"><span class="dfn">Received on</span> Wed Nov 3 17:49:23 2010</span> </div> <div class="foot"> * <span class="dfn">This message</span>: [ [[#start|Message body]] ] * <span class="dfn">Next message</span>: [[0002.html|Sebastian Steinhuber: "[vserver] Failing to start vserver -- since patch-2.6.36-vs2.3.0.36.38"]] * <span class="dfn">Previous message</span>: [[0000.html|Oliver Heinz: "Re: [vserver] Rant/Moved"]] * <span class="dfn">Next in thread</span>: [[0005.html|Rik Bobbaers: "Re: [vserver] Vserver + grsec thoughts"]] * <span id="replies"></span><span class="dfn">Reply</span>: [[0005.html|Rik Bobbaers: "Re: [vserver] Vserver + grsec thoughts"]] * <span id="options2"></span><span class="dfn">Contemporary messages sorted</span>: [ [[date.html#1|By Date]] ] [ [[index.html#1|By Thread]] ] [ [[subject.html#1|By Subject]] ] [ [[author.html#1|By Author]] ] [ [[attachment.html|By messages with attachments]] ] </div> <div align="center"> [<nowiki/>[[../|Next/Previous Months]]] [<nowiki/>[http://www.solucorp.qc.ca/miscprj/s_context.hc Main vserver Project Homepage]] [<nowiki/>[http://www.solucorp.qc.ca/mlist/index.hc?list=vserver Howto Subscribe/Unsubscribe]] [<nowiki/>[http://www.paul.sladen.org/vserver/ Paul Sladen's vserver stuff]]<br /> <span class="small">Generated on Wed 03 Nov 2010 - 17:49:23 GMT by [http://www.hypermail.org/ hypermail 2.1.8]</span> </div>
Summary:
Please note that all contributions to Linix VServer may be edited, altered, or removed by other contributors. If you do not want your writing to be edited mercilessly, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource (see
Linix VServer:Copyrights
for details).
Do not submit copyrighted work without permission!
Cancel
Editing help
(opens in new window)
Navigation menu
Page actions
Page
Discussion
Read
Edit
History
Page actions
Page
Discussion
More
Tools
Personal tools
Not logged in
Talk
Contributions
Create account
Log in
About
Overview
Paper
News
Developers
Donations
Search
Getting Started
Downloads
FAQs
Documentation
Support
Participate
How to participate
Report a Bug
Communicate
Teams/Projects
Hall of Fame
Resources
Archives
Recent Wiki Changes
Pastebin
Related Projects
VServer Hosting
Happy VServer Users
Tools
What links here
Related changes
Special pages
Page information