Subject: Re: [vserver] Patch for 2.6.38.4 vserver + GR Security
From: Herbert Poetzl <herbert@13thfloor.at>
Date: Wed, 11 May 2011 15:07:10 +0200

On Wed, May 11, 2011 at 02:07:53PM +0200, Rik Bobbaers wrote:

> your patch won't work for a lot of instances...

> one of the most important errors you made, is not changing the
> atomic values, used by vserver to unchecked atomic values.
> Bertl uses those counters so that they can (and are supposed
> to) overflow. Therefore you have to change them to "unchecked"
> atomics. You will get REFCOUNT overflow bugs in your kernel
> (and corresponding panics).

> So please... read my "vserver+grsec howto" from a couple of
> months ago before taking this project on yourself ;)

in general, I'd suggest to do patches _against_ a Linux-VServer
patched kernel and not combination patches, as it simplifies
the process of updating to newer Linux-VServer and kernel 
versions ...

best,
Herbert

> read this thread first:
> http://archives.linux-vserver.org/201011/0001.html

> KR

> Rik Bobbaers

> -- http://harry.enzoverder.be

>> http://sandino.araico.net/parches/vserver/patch-2.6.38.4-vs2.3
>> .0.37-rc15-grsec-2.2.2-201104232142-KB1.diff

>> -- Sandino Araico Sánchez http://sandino.net