Subject: Re: [vserver] vserver saves my ass yet again
From: Eugen Leitl <eugen@leitl.org>
Date: Mon, 20 Dec 2010 19:10:12 +0100

On Mon, Dec 20, 2010 at 05:19:42PM +0000, Ed W wrote:

> Curiously enough - vserver + grsec would have apparently prevented the  
> root escalation in the first place (if only because of limiting access  
> to kallsyms?).

I'm using the Bristol wireless kernels from the repo
deb http://repo.psand.net/ lenny main

(incidentally, after having installed two systems with
2.6.36-vs2.3.0.36.38-beng today, are these safe to use
in production, or should I go back to
2.6.31.14-vs2.3.0.36.28.2-beng ?) which don't come
with grsec+pax (or whatever de rigeur is these days).

Are there any prepackaged debian kernels with grsec patch
out there? I'm not aware of any, and I'd hate to roll
my own. Does one need to define a policy to go with 
it, for that matter? This is always a problem with SELinux,
the stock policy is largely useless, and without a
carefully manually crafted one SELinux is a point of
breakage ("just turn it off, and 90% of problems will
go away").

> Kernel level root escalations are quite scary in a virtualised  
> environment - it would be interesting to get an idea from Herbert about  

Indeed, especially if one wants to run hundreds of guests/machine for 
semianonymous, possibly hostile users. Even with remote 
take-off-and-nuke-from-orbit-via-IPMI and reinstall guests
from backup is a) still annoying b) will have you compromised
in a second, if you or your users invoke compromised binaries
from the archive.

> whether that level of kernel escalation allows the rooted user to escape  
> from the vserver jail, and whether there is anything further that can be  
> done to limit that in practice?

I would be very interested in grsec etc. patched kernels.
I would be even willing to build these and test them, provided
somebody writes down a good recipe for how to apply patches
and roll Debian packages from these which are as functional
as those from the Bristol Wireless repo.

-- 
Eugen* Leitl <a href="leitlhttp://leitl.org">leitl</a> http://leitl.org
______________________________________________________________
ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org
8B29F6BE: 099D 78BA 2FD3 B014 B08A  7779 75B0 2443 8B29 F6BE