Subject: [Grsec] audit denies pivot_root ?
From: Romain Riviere <romain.riviere@gmail.com>
Date: Fri, 19 Nov 2010 16:39:44 +0100

 Fri, 19 Nov 2010 16:39:44 +0100
Hello,

I've just set up a brand new Gentoo box with the latest experimental release (2.6.36-grsec2.2.0-vs2.3.0.36.38)
and util-vserver (0.30.216 pre2924). I have created a guest from the latest Gentoo stage4,
assigned a public IP from the host's eth0, and everything else is default.

The problem is that "vserver <name> start" fails with "vcontext: pivot root(): Invalid
argument" if kernel.grsecurity.audit mount or kernel.grsecurity.audit chdir are enabled.
However, while audit mount is seemingly an impassable obstacle (ie. the guest never
starts), audit chdir can be defeated after several start attempts (3 in my experience).
There are no errors in dmesg/kernel.log whatsoever, only the expected mount/chdir audit
lines can be seen.

Attached is the current status of my grsec/pax settings. Any clues/pointers would be
appreciated !

Cheers,

Romain

kernel.grsecurity.linking restrictions = 1
kernel.grsecurity.fifo restrictions = 1
kernel.grsecurity.execve limiting = 1
kernel.grsecurity.ip blackhole = 1
kernel.grsecurity.lastack retries = 4
kernel.grsecurity.exec logging = 0
kernel.grsecurity.signal logging = 1
kernel.grsecurity.forkfail logging = 1
kernel.grsecurity.timechange logging = 1
kernel.grsecurity.chroot deny shmat = 1
kernel.grsecurity.chroot deny unix = 1
kernel.grsecurity.chroot deny fchdir = 1
kernel.grsecurity.chroot deny pivot = 1
kernel.grsecurity.chroot enforce chdir = 1
kernel.grsecurity.chroot deny mknod = 1
kernel.grsecurity.chroot restrict nice = 1
kernel.grsecurity.chroot execlog = 1
kernel.grsecurity.chroot deny sysctl = 1
kernel.grsecurity.tpe = 1
kernel.grsecurity.tpe gid = 32767
kernel.grsecurity.tpe restrict all = 1
kernel.grsecurity.socket all = 1
kernel.grsecurity.socket all gid = 32768
kernel.grsecurity.socket client = 1
kernel.grsecurity.socket client gid = 32768
kernel.grsecurity.socket server = 1
kernel.grsecurity.socket server gid = 32768
kernel.grsecurity.audit chdir = 0
kernel.grsecurity.audit mount = 0
kernel.grsecurity.dmesg = 1
kernel.grsecurity.resource logging = 1
kernel.grsecurity.audit ptrace = 1
kernel.grsecurity.harden ptrace = 1
kernel.grsecurity.grsec lock = 0

CONFIG PAX PER CPU PGD=y
CONFIG PAX ENABLE PAE=y
CONFIG PAX=y
# CONFIG PAX SOFTMODE is not set
CONFIG PAX EI PAX=y
CONFIG PAX PT PAX FLAGS=y
CONFIG PAX NO ACL FLAGS=y
# CONFIG PAX HAVE ACL FLAGS is not set
# CONFIG PAX HOOK ACL FLAGS is not set
CONFIG PAX NOEXEC=y
CONFIG PAX PAGEEXEC=y
# CONFIG PAX SEGMEXEC is not set
CONFIG PAX EMUTRAMP=y
CONFIG PAX MPROTECT=y
# CONFIG PAX ELFRELOCS is not set
CONFIG PAX KERNEXEC=y
CONFIG PAX ASLR=y
CONFIG PAX RANDKSTACK=y
CONFIG PAX RANDUSTACK=y
CONFIG PAX RANDMMAP=y
# CONFIG PAX MEMORY SANITIZE is not set
CONFIG PAX MEMORY UDEREF=y
CONFIG PAX REFCOUNT=y
CONFIG PAX USERCOPY=y