Subject: Re: [vserver] grsec change propositions
From: Jan Pobrislo <ccx@webprojekty.cz>
Date: Thu, 17 Jun 2010 17:05:51 +0200
Thu, 17 Jun 2010 17:05:51 +0200
On Thursday 17 June 2010 16:53:41 Rik Bobbaers wrote:
> 3 possibilities:
> 1. disable ALL chroot restrictions when vserver kernel is enabled
> 2. disable the 4 restrictions and leave the choice for the rest of the
> chroot restrictions
> 3. SCREW IT, I'm a grown boy, i decide what i want, this is a free country
> (wether or not you live in one ;))

I would like to have number 2.

> anyway, I personally would disable all chroot restrictions, since security
> on the guests is primarily enforced by vserver code itself.

It is not always optimal to create separate vserver for each service and some 
applications do their own chrooting (rsync, pure-ftp comes to mind). So not 
all chrooting on vserver-enabled system is done by vserver itself and some 
might need some additional hardening. But I'm in favor of kicking the ones 
that break vserver.


["application/pgp-signature" not shown]