On Mon, Dec 20, 2010 at 05:19:42PM +0000, Ed W wrote: > Curiously enough - vserver + grsec would have apparently prevented the > root escalation in the first place (if only because of limiting access > to kallsyms?). I'm using the Bristol wireless kernels from the repo deb http://repo.psand.net/ lenny main (incidentally, after having installed two systems with 2.6.36-vs2.3.0.36.38-beng today, are these safe to use in production, or should I go back to 2.6.31.14-vs2.3.0.36.28.2-beng ?) which don't come with grsec+pax (or whatever de rigeur is these days). Are there any prepackaged debian kernels with grsec patch out there? I'm not aware of any, and I'd hate to roll my own. Does one need to define a policy to go with it, for that matter? This is always a problem with SELinux, the stock policy is largely useless, and without a carefully manually crafted one SELinux is a point of breakage ("just turn it off, and 90% of problems will go away"). > Kernel level root escalations are quite scary in a virtualised > environment - it would be interesting to get an idea from Herbert about Indeed, especially if one wants to run hundreds of guests/machine for semianonymous, possibly hostile users. Even with remote take-off-and-nuke-from-orbit-via-IPMI and reinstall guests from backup is a) still annoying b) will have you compromised in a second, if you or your users invoke compromised binaries from the archive. > whether that level of kernel escalation allows the rooted user to escape > from the vserver jail, and whether there is anything further that can be > done to limit that in practice? I would be very interested in grsec etc. patched kernels. I would be even willing to build these and test them, provided somebody writes down a good recipe for how to apply patches and roll Debian packages from these which are as functional as those from the Bristol Wireless repo. -- Eugen* Leitl <a href="leitlhttp://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE