Subject: Re: [vserver] grsec change propositions
From: "Rik Bobbaers" <rik@enzoverder.be>
Date: Mon, 21 Jun 2010 15:47:22 +0200 (CEST)

> probably it is not good way to block GRKERNSEC_CHROOT_FINDTASK and
> GRKERNSEC_CHROOT_DOUBLE cos someone (me) does not use/need/allow chroot
> in chroot

true, but as soon as someone uses e.g. vsftpd or so with a chroot option
or anything
else they might not know it uses chroot, their programs won't work anymore
with
those options enabled. So I think it's generally a good sollution to keep
those 2
disabled anyway. Also because you're protected by the use of
namespaces/contexts for
these kind of attacks. (unless there's a bug in those ones aswell)

But if most of the people here would like to see it enable-able again, let
me know!
I'll change it again!

Greetings,

Rik Bobbaers

-- http://harry.enzoverder.be
linux/unix/system/network/security/hardware admin
infrastructure architect