Subject: Re: [vserver] Kernel bug in __sock_sendmsg
From: Jan Pobrislo <ccx@webprojekty.cz>
Date: Tue, 15 Jun 2010 15:52:54 +0200
Tue, 15 Jun 2010 15:52:54 +0200
On Tuesday 15 June 2010 15:18:20 you wrote:

> can you please read the readme on my page:
> http://people.linux-vserver.org/~harry/

I've read that page before and I've set it accordingly:
kernel.grsecurity.chroot caps = 0
kernel.grsecurity.chroot deny chmod = 0
kernel.grsecurity.chroot deny chroot = 0
kernel.grsecurity.chroot deny mount = 0
kernel.grsecurity.chroot findtask = 0

kernel.grsecurity.chroot deny fchdir = 1
kernel.grsecurity.chroot deny mknod = 1
kernel.grsecurity.chroot deny pivot = 1
kernel.grsecurity.chroot deny shmat = 1
kernel.grsecurity.chroot deny sysctl = 1
kernel.grsecurity.chroot deny unix = 1
kernel.grsecurity.chroot enforce chdir = 1
kernel.grsecurity.chroot restrict nice = 1

I can disable remaining restrictions, but I don't see how it correlates with 
PAX catching refcount overflow. VServer starts normally, just after some time 
(I guess when some amount data was transmitted/received) all processes which 
try to do networking freeze. Then I have to restart the vserver to make it 
work again.

> and while you're at it, use the latest patch for 2.6.32.15. It contains
> some bugfixes too.

The server is quite hard to approach physically, so I would like to keep 
reboots to minimum. Are there changes in vserver code or only in linux 
version?

Thanks,
Jan Pobrislo


["application/pgp-signature" not shown]