Subject: Re: [vserver] Patch for 2.6.38.4 vserver + GR Security
From: "Rik Bobbaers" <rik@enzoverder.be>
Date: Wed, 11 May 2011 16:14:59 +0200 (CEST)

that is an option as well off course :)

I'll see if i can spin patches like that if ever i find the time for it
(sorry all...)

KR

Rik Bobbaers

-- http://harry.enzoverder.be

> On Wed, May 11, 2011 at 02:07:53PM +0200, Rik Bobbaers wrote:
>
>> your patch won't work for a lot of instances...
>
>> one of the most important errors you made, is not changing the
>> atomic values, used by vserver to unchecked atomic values.
>> Bertl uses those counters so that they can (and are supposed
>> to) overflow. Therefore you have to change them to "unchecked"
>> atomics. You will get REFCOUNT overflow bugs in your kernel
>> (and corresponding panics).
>
>> So please... read my "vserver+grsec howto" from a couple of
>> months ago before taking this project on yourself ;)
>
> in general, I'd suggest to do patches _against_ a Linux-VServer
> patched kernel and not combination patches, as it simplifies
> the process of updating to newer Linux-VServer and kernel
> versions ...
>
> best,
> Herbert
>
>> read this thread first:
>> http://archives.linux-vserver.org/201011/0001.html
>
>> KR
>
>> Rik Bobbaers
>
>> -- http://harry.enzoverder.be
>
>>> http://sandino.araico.net/parches/vserver/patch-2.6.38.4-vs2.3
>>> .0.37-rc15-grsec-2.2.2-201104232142-KB1.diff
>
>>> -- Sandino Araico Sánchez http://sandino.net
>