Tue, 15 Jun 2010 15:52:54 +0200
On Tuesday 15 June 2010 15:18:20 you wrote:
> can you please read the readme on my page:
> http://people.linux-vserver.org/~harry/
I've read that page before and I've set it accordingly:
kernel.grsecurity.chroot caps = 0
kernel.grsecurity.chroot deny chmod = 0
kernel.grsecurity.chroot deny chroot = 0
kernel.grsecurity.chroot deny mount = 0
kernel.grsecurity.chroot findtask = 0
kernel.grsecurity.chroot deny fchdir = 1
kernel.grsecurity.chroot deny mknod = 1
kernel.grsecurity.chroot deny pivot = 1
kernel.grsecurity.chroot deny shmat = 1
kernel.grsecurity.chroot deny sysctl = 1
kernel.grsecurity.chroot deny unix = 1
kernel.grsecurity.chroot enforce chdir = 1
kernel.grsecurity.chroot restrict nice = 1
I can disable remaining restrictions, but I don't see how it correlates with
PAX catching refcount overflow. VServer starts normally, just after some time
(I guess when some amount data was transmitted/received) all processes which
try to do networking freeze. Then I have to restart the vserver to make it
work again.
> and while you're at it, use the latest patch for 2.6.32.15. It contains
> some bugfixes too.
The server is quite hard to approach physically, so I would like to keep
reboots to minimum. Are there changes in vserver code or only in linux
version?
Thanks,
Jan Pobrislo
["application/pgp-signature" not shown]