Subject: Re: [vserver] Patch for 2.6.38.4 vserver + GR Security
From: Ed W <lists@wildgooses.com>
Date: Wed, 18 May 2011 18:10:10 +0100

 Wed, 18 May 2011 18:10:10 +0100
On 14/05/2011 09:01, Sandino Araico Sánchez wrote:
> After the refcount fix (thanks Rik for your advice) I have the new
> kernel running for more than 23 hours with no visible failure.
> 
> The vserver patch against a grsec-patched kernel:
> http://sandino.araico.net/parches/vserver/patch-2.6.38.4-vs2.3.0.37-rc15-against-grsec-2.2.2-201104232142-KB2-unstable.diff
> 
> The combined patch against 2.6.38.4 vanilla:
> http://sandino.araico.net/parches/vserver/patch-2.6.38.4-vs2.3.0.37-rc15-grsec-2.2.2-201104232142-KB2-unstable.diff

Superb

Do also consider if you need the extra stuff in grsec or just the pax
part? I'm moving quickly to the opinion that pax is the main useful
thing on a vserver based server (assuming little/nothing running the
host).  Herbert suggests that most of the chroot restrictions are
already taken care of by vserver code?

Cheers

Ed W