Subject: Re: [vserver] secure-mount, operation not permitted at start
From: Shinkan <shinkan@gmail.com>
Date: Fri, 15 Jan 2010 10:34:35 +0100
Fri, 15 Jan 2010 10:34:35 +0100
2010/1/15 Shinkan <shinkan@gmail.com>

>
>
> 2010/1/15 Rik Bobbaers <rik@enzoverder.be>
>
>> as i thought...
>>
>>
>> CONFIG_GRKERNSEC_CHROOT_MOUNT=y
>>
>> please read this:
>> http://people.linux-vserver.org/~harry/<http://people.linux-vserver.org/%7Eharry/>(bottom
of the page)
>> on the settings needed for vserver to work..
>>
>> grtzzz...
>>
>> Rik Bobbaers
>>
>>
> I understand your frustration but hey, I checked that before asking !
> cat /proc/sys/kernel/grsecurity/chroot_deny_mount output 0 (I set it with
> systcl.conf and rebooted to be sure that was not the reason).
> That should be sufficient isn't it ?
>
>
I suspected CONFIG_GRKERNSEC_CHROOT_CAPS.
I disabled it by proc, and all "secure-mount" related problems dissapeared.

BUT, I still have "/usr/sbin/chbind" related "Segmentation fault" :S
I'll try to compile my kernel with your suggested opts (on linked page), but
I don't trust it would solve this kind of crash :S

-- 
Pierre.
"Sometimes when I'm talking, my words can't keep up with my thoughts. I
wonder why we think faster than we speak. Probably so we can think twice." -
Bill Watterson




2010/1/15 Shinkan <shinkan@gmail.com>


2010/1/15 Rik Bobbaers <rik@enzoverder.be>
as i thought...


CONFIG GRKERNSEC CHROOT MOUNT=y

please read this:
http://people.linux-vserver.org/~harry/ (bottom of the page)
on the settings needed for vserver to work..

grtzzz...

Rik Bobbaers


I understand your frustration but hey, I checked that before asking !
cat /proc/sys/kernel/grsecurity/chroot deny mount output 0 (I set it with systcl.conf and rebooted to be sure that was not the reason).
That should be sufficient isn't it ?

 
I suspected CONFIG GRKERNSEC CHROOT CAPS.
I disabled it by proc, and all "secure-mount" related problems dissapeared.

BUT, I still have "/usr/sbin/chbind" related "Segmentation fault" :S
I'll try to compile my kernel with your suggested opts (on linked page), but I don't trust it would solve this kind of crash :S

--
Pierre.
"Sometimes when I'm talking, my words can't keep up with my thoughts. I wonder why we think faster than we speak. Probably so we can think twice." - Bill Watterson