Mniej wiecej Thu, Feb 14, 2008 at 10:10:10AM +0100, zainteresowany Natanael Copa rzekl: > Hi, > > I have been thinking lately of the grsecury patch. There are many > features in grsecurity that is redundant or does not really work very > well with vserver. What features don't work? > Does RBAC really work in a vserver? Can you set up policies for each > vserver? I doubt it and if not, the RBAC is pretty useless. Yes, of course it works. RBAC knows nothing that process in inside vserver (doesn't care about XID and NID), it is only process, isolated, not virtualized. So if you use vservers in classic configuration (with chroots), you just need prefix subjects and objects with /vservers/<name>. Simple example: subject /vservers o / h subject /vservers/www/bin /vservers /vservers/www/bin rx /vservers/www/etc rx /vservers/www/lib rxi [...] First problem here is to manage such policy, it is not pretty readable. Other thing is vhashify - if you use it RBAC will refuse policy because of hard links. For existing files grsec uses inodes, there will be posibility to create duplicates in policy what is prohibited. > grsecurity also provides some features to prevent escaping from a > chroot. A vserver is a chroot and has its own mechanism to prevent > escaping. So I think the additiona features provided in grsecurity > should be added to vserver if they are needed. But where is the problem? Two projects provides independent implementations of similar functionality. If used together must be configured with caution. That's all. > So whats left in grsecurity? The extra logging. Not very useful for > vservers (logs be very easily flooded) Logging can be turned on only for some existences, like signals, mounts or for group. Grsecurity provides also proc restrictions func, which you may want inside vserver (and yes - it works fine), TPE likewise. > So whats left is basicly Pax which makes really sense to have. There is > a separate patch for PaX only which is updated more often than the full > grsecurity patch. > > Might be an idea to combine vserver+pax rather than vserver+grsecurity? There is not problem to create vserver+pax. Also not problem to use vserver+grsec(with rbac)+pax, I have such configurations. Zbyniu -- %% Absolutely nothing we trust %%