Subject: Re: [vserver] grsec releases
From: ccx@webprojekty.cz
Date: Thu, 15 Sep 2011 09:11:04 +0200
Thu, 15 Sep 2011 09:11:04 +0200
On Wed, Sep 14, 2011 at 09:19:01PM +0100, Ed W wrote:
> My vote is we shift to a pax only patch (perhaps with a few select bits
> from the grsec patch, eg larger entropy pool and similar)
> 
> Pax applies (or did apply) with no significant conflicts and just
> requires the additional atomic changes to the vserver code. 

Grsec is much more than RBAC, features I'd highlight are:

* Kernel auditing: reporting of all segfaults, limit oversteps, etc.

* Adress space protection: remove all the userspace access to low-level
    stuff that could compromise the system.

* Proc restrictions: users only able to inspect their own processes,
    this is really handy for a shell server.

* /tmp race protection for symlinks and fifo.

But having PAX is still much better than not having it :-)

For reference I attach snippet of my kernel configuration:

linux-2.6.36.2-vserver-grsec # grep GRKER .config
CONFIG GRKERNSEC=y
# CONFIG GRKERNSEC LOW is not set
# CONFIG GRKERNSEC MEDIUM is not set
# CONFIG GRKERNSEC HIGH is not set
CONFIG GRKERNSEC CUSTOM=y
CONFIG GRKERNSEC KMEM=y
# CONFIG GRKERNSEC IO is not set
CONFIG GRKERNSEC PROC MEMMAP=y
# CONFIG GRKERNSEC BRUTE is not set
CONFIG GRKERNSEC MODHARDEN=y
CONFIG GRKERNSEC HIDESYM=y
# CONFIG GRKERNSEC NO RBAC is not set
# CONFIG GRKERNSEC ACL HIDEKERN is not set
CONFIG GRKERNSEC ACL MAXTRIES=3
CONFIG GRKERNSEC ACL TIMEOUT=30
CONFIG GRKERNSEC PROC=y
CONFIG GRKERNSEC PROC USER=y
CONFIG GRKERNSEC PROC ADD=y
CONFIG GRKERNSEC LINK=y
CONFIG GRKERNSEC FIFO=y
# CONFIG GRKERNSEC ROFS is not set
CONFIG GRKERNSEC CHROOT=y
CONFIG GRKERNSEC CHROOT PIVOT=y
CONFIG GRKERNSEC CHROOT CHDIR=y
CONFIG GRKERNSEC CHROOT FCHDIR=y
CONFIG GRKERNSEC CHROOT MKNOD=y
# CONFIG GRKERNSEC CHROOT SHMAT is not set
# CONFIG GRKERNSEC CHROOT UNIX is not set
# CONFIG GRKERNSEC CHROOT NICE is not set
CONFIG GRKERNSEC CHROOT SYSCTL=y
# CONFIG GRKERNSEC AUDIT GROUP is not set
# CONFIG GRKERNSEC EXECLOG is not set
CONFIG GRKERNSEC RESLOG=y
# CONFIG GRKERNSEC CHROOT EXECLOG is not set
CONFIG GRKERNSEC AUDIT PTRACE=y
# CONFIG GRKERNSEC AUDIT CHDIR is not set
CONFIG GRKERNSEC AUDIT MOUNT=y
CONFIG GRKERNSEC SIGNAL=y
CONFIG GRKERNSEC FORKFAIL=y
CONFIG GRKERNSEC TIME=y
CONFIG GRKERNSEC PROC IPADDR=y
CONFIG GRKERNSEC EXECVE=y
CONFIG GRKERNSEC DMESG=y
CONFIG GRKERNSEC HARDEN PTRACE=y
# CONFIG GRKERNSEC TPE is not set
CONFIG GRKERNSEC RANDNET=y
# CONFIG GRKERNSEC BLACKHOLE is not set
# CONFIG GRKERNSEC SOCKET is not set
CONFIG GRKERNSEC SYSCTL=y
# CONFIG GRKERNSEC SYSCTL ON is not set
CONFIG GRKERNSEC FLOODTIME=10
CONFIG GRKERNSEC FLOODBURST=4


["application/pgp-signature" not shown]