Heya all, As Bertl isn't a real fan of the vserver+grsec merge since it's easy to run into problems when you don't properly configure stuff. SO, a proposition: vserver is largely based on chroot and lots of options related to that. The grsecurity part has a famous "chroot restrictions" list. Some options need to be disabled to make vservers work properly. Right now, leave the choice to the user to config it, but it causes problems when you "just enable all" 3 possibilities: 1. disable ALL chroot restrictions when vserver kernel is enabled 2. disable the 4 restrictions and leave the choice for the rest of the chroot restrictions 3. SCREW IT, I'm a grown boy, i decide what i want, this is a free country (wether or not you live in one ;)) anyway, I personally would disable all chroot restrictions, since security on the guests is primarily enforced by vserver code itself. The second option has more options for the user (do you want that?) The third option is maybe not optimal since noobs will run into problems. Are there more requests on "better integration" of grsecurity and linux-vserver? ps. i'm not an expert in the linux-vserver code nor the grsecurity/pax code, so don't ask me to completely rewrite any of the 2! ;) Bertl: you're the leader of the linux-vserver, so your suggestions weigh more in discussions! I want you to "enjoy" having a vserver+grsecurity patch instead of resenting it. anyway: let the discussions run wild!!! ;) Rik Bobbaers -- http://harry.enzoverder.be linux/unix/system/network/security/hardware admin infrastructure architect