Fri, 19 Nov 2010 16:39:44 +0100 Hello, I've just set up a brand new Gentoo box with the latest experimental release (2.6.36-grsec2.2.0-vs2.3.0.36.38) and util-vserver (0.30.216 pre2924). I have created a guest from the latest Gentoo stage4, assigned a public IP from the host's eth0, and everything else is default. The problem is that "vserver <name> start" fails with "vcontext: pivot root(): Invalid argument" if kernel.grsecurity.audit mount or kernel.grsecurity.audit chdir are enabled. However, while audit mount is seemingly an impassable obstacle (ie. the guest never starts), audit chdir can be defeated after several start attempts (3 in my experience). There are no errors in dmesg/kernel.log whatsoever, only the expected mount/chdir audit lines can be seen. Attached is the current status of my grsec/pax settings. Any clues/pointers would be appreciated ! Cheers, Romain kernel.grsecurity.linking restrictions = 1 kernel.grsecurity.fifo restrictions = 1 kernel.grsecurity.execve limiting = 1 kernel.grsecurity.ip blackhole = 1 kernel.grsecurity.lastack retries = 4 kernel.grsecurity.exec logging = 0 kernel.grsecurity.signal logging = 1 kernel.grsecurity.forkfail logging = 1 kernel.grsecurity.timechange logging = 1 kernel.grsecurity.chroot deny shmat = 1 kernel.grsecurity.chroot deny unix = 1 kernel.grsecurity.chroot deny fchdir = 1 kernel.grsecurity.chroot deny pivot = 1 kernel.grsecurity.chroot enforce chdir = 1 kernel.grsecurity.chroot deny mknod = 1 kernel.grsecurity.chroot restrict nice = 1 kernel.grsecurity.chroot execlog = 1 kernel.grsecurity.chroot deny sysctl = 1 kernel.grsecurity.tpe = 1 kernel.grsecurity.tpe gid = 32767 kernel.grsecurity.tpe restrict all = 1 kernel.grsecurity.socket all = 1 kernel.grsecurity.socket all gid = 32768 kernel.grsecurity.socket client = 1 kernel.grsecurity.socket client gid = 32768 kernel.grsecurity.socket server = 1 kernel.grsecurity.socket server gid = 32768 kernel.grsecurity.audit chdir = 0 kernel.grsecurity.audit mount = 0 kernel.grsecurity.dmesg = 1 kernel.grsecurity.resource logging = 1 kernel.grsecurity.audit ptrace = 1 kernel.grsecurity.harden ptrace = 1 kernel.grsecurity.grsec lock = 0 CONFIG PAX PER CPU PGD=y CONFIG PAX ENABLE PAE=y CONFIG PAX=y # CONFIG PAX SOFTMODE is not set CONFIG PAX EI PAX=y CONFIG PAX PT PAX FLAGS=y CONFIG PAX NO ACL FLAGS=y # CONFIG PAX HAVE ACL FLAGS is not set # CONFIG PAX HOOK ACL FLAGS is not set CONFIG PAX NOEXEC=y CONFIG PAX PAGEEXEC=y # CONFIG PAX SEGMEXEC is not set CONFIG PAX EMUTRAMP=y CONFIG PAX MPROTECT=y # CONFIG PAX ELFRELOCS is not set CONFIG PAX KERNEXEC=y CONFIG PAX ASLR=y CONFIG PAX RANDKSTACK=y CONFIG PAX RANDUSTACK=y CONFIG PAX RANDMMAP=y # CONFIG PAX MEMORY SANITIZE is not set CONFIG PAX MEMORY UDEREF=y CONFIG PAX REFCOUNT=y CONFIG PAX USERCOPY=y