Subject: Re: [vserver] Can't see all my processes?
From: vitalyb <vitalyvb@ukr.net>
Date: Tue, 13 May 2008 18:03:45 +0300

Ed W wrote:
> David Karban wrote:
>> Ed W napsal(a):
>>> Hi
>> Hi,
>> I had same issue with bind run in vserver in chroot jail with 
>> grsecurity chroot jail protection. Bind process was visible from host 
>> by vps, but not in guest. Without chroot jail protection was visible 
>> in guest too.
>>
>> But the question is ... are you chrooting in vserver ?
> 
> Aha, I'm not knowingly chrooting, but then this is a bit of bernstein 
> software, so I guess that it quite probably does a chroot (dnscache)
> 
> Any tips on adjusting grsec?  I'm not sure really why the chroot 
> protection would cause this effect?  Presumably it's somehow causing the 
> process security tags to change in some way?
> 

It's GRKERNSEC_CHROOT_FINDTASK. It should be either disabled in kernel or
by kernel.grsecurity.chroot_findtask=0 sysctl.

config GRKERNSEC_CHROOT_FINDTASK
         bool "Protect outside processes"
         depends on GRKERNSEC_CHROOT
         help
           If you say Y here, processes inside a chroot will not be able to
           kill, send signals with fcntl, ptrace, capget, getpgid, getsid,
           or view any process outside of the chroot.  If the sysctl
           option is enabled, a sysctl option with name "chroot_findtask" is
           created.


-- 
Regards,
Vitaly