Subject: grsec change propositions
From: "Rik Bobbaers" <rik@enzoverder.be>
Date: Thu, 17 Jun 2010 16:53:41 +0200 (CEST)

Heya all,

As Bertl isn't a real fan of the vserver+grsec merge since it's easy to
run into problems when you don't properly configure stuff.

SO, a proposition:
vserver is largely based on chroot and lots of options related to that.
The grsecurity part has a famous "chroot restrictions" list. Some options
need to be disabled to make vservers work properly. Right now, leave the
choice to the user to config it, but it causes problems when you "just
enable all"

3 possibilities:
1. disable ALL chroot restrictions when vserver kernel is enabled
2. disable the 4 restrictions and leave the choice for the rest of the
chroot restrictions
3. SCREW IT, I'm a grown boy, i decide what i want, this is a free country
(wether or not you live in one ;))

anyway, I personally would disable all chroot restrictions, since security
on the guests is primarily enforced by vserver code itself. The second
option has more options for the user (do you want that?)
The third option is maybe not optimal since noobs will run into problems.

Are there more requests on "better integration" of grsecurity and
linux-vserver?

ps. i'm not an expert in the linux-vserver code nor the grsecurity/pax
code, so don't ask me to completely rewrite any of the 2! ;)

Bertl: you're the leader of the linux-vserver, so your suggestions weigh
more in discussions! I want you to "enjoy" having a vserver+grsecurity
patch instead of resenting it.

anyway: let the discussions run wild!!! ;)

Rik Bobbaers

-- http://harry.enzoverder.be
linux/unix/system/network/security/hardware admin
infrastructure architect