Subject: Re: [vserver] vserver+grsecurity patch
From: Natanael Copa <natanael.copa@gmail.com>
Date: Fri, 10 Oct 2008 10:08:51 +0200

On Fri, 2008-10-10 at 09:33 +0200, Rik Bobbaers wrote:
> damn...
> 
> i allmost finished my patch for 2.6.26.6... and now there is a new kernel
> release: 2.6.27
> do you still want it? 

yes please.

> or do we wait for a testpatch for grsec and use the
> pre of vserver to do a merge?
> 
> you da ... ahm... people, you tell me! ;)

I can only speak for me, but i think 2.6.27 needs a few dot releleases
before i consider upgrade. Even 2.6.26 is considered "unstable/testing"
for Gentoo hardened.

Thanks!

> Rik Bobbaers
> 
> -- http://harry.enzoverder.be
> linux/unix/system/network/security/hardware/DR admin
> 
> > On Tue, 2008-10-07 at 18:26 +0200, Rik Bobbaers wrote:
> >> true... was/is... :)
> >>
> >> my thoughts were... i follow the stable branch of vserver, because you
> >> only want enhanced security on the really stable kernels... so i still
> >> try to keep up with the stable patches, it's just been a while since
> >> the last stable patch.
> >
> > My problem now is that "current stable" is not stable at all. Try it on
> > qemu/kvm yourself and you'll see. Same thing happen on different kinds
> > of hardware. (i gant find out exatct what hardware if you'd like)
> >
> > I'm pretty sure the problem is in the grsecrity patch (iirc there as
> > some issues like that even without the vserver patch) and I'm sure that
> > if I ask grsecurity guys about it, they'll say "use latest kernel".
> >
> >> i've had this question numerous times, but as long as the vserver
> >> patch isn't stable, i don't see a lot of use for "updating" the patch
> >> to the latest vserver and grsec
> >>
> >> but if there is a general demand... i'll find some time to do it if
> >> you like :)
> >
> > well, the current stable patch is broken, so yes, it would be nice.
> >
> > However, before you spend time on it, I'll ask on the grsecurity list.
> > Maybe they have a tip on a backported fix.
> >
> >> grtzzz...
> >>
> >> * Herbert Poetzl <herbert@13thfloor.at>, 2008-10-02 15:47:51 Thu:
> >> > On Tue, Sep 30, 2008 at 03:22:01PM +0200, Natanael Copa wrote:
> >> > > Hi,
> >> > >
> >> > > I have some issues with using the vserver + grsecurity patch. It
> >> crashes
> >> > > in qemu, kvm and some other real hardware.
> >> > >
> >> > > I know there are some issues fixed in gresecurity releases for newer
> >> > > kernels. Are there any change to get a newer vserver experimental +
> >> > > grsecurity patch? for either 2.6.25 or 2.6.26.
> >> >
> >> > best talk to harry, he was (is?) maintaining
> >> > the combo patches (Linux-VServer + grsec)
> >> >
> >> > best,
> >> > Herbert
> >> >
> >> > >
> >> > > Thanks!
> >> > >
> >> > > -nc
> >>
> >
> >
>