Subject: Patch for 2.6.32.43 vserver + GR Security
From:Sandino Araico Sánchez <sandino@sandino.net>
Date: Tue, 19 Jul 2011 05:10:44 -0500
Tue, 19 Jul 2011 05:10:44 -0500
The combined patch against 2.6.32.43 vanilla:
http://sandino.araico.net/parches/vserver/patch-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110.diff
http://sandino.araico.net/parches/vserver/patch-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110.diff.asc

The grsec patch against a vserver-patched kernel:
http://sandino.araico.net/parches/vserver/patch-grsec-2.2.2-201107142110-against-2.6.32.43-vs2.3.0.36.29.7.diff
http://sandino.araico.net/parches/vserver/patch-grsec-2.2.2-201107142110-against-2.6.32.43-vs2.3.0.36.29.7.diff.asc

I have been using this kernel for 3 days in production servers without a 
reboot.

An important change is a bugfix in PaX where some 32-bit processes were 
being killed with a SIGBUS
http://forums.grsecurity.net/viewtopic.php?f=3&t=2618
https://bugs.gentoo.org/365915?id=365915

Another patch you might wish to apply is 
https://bugs.gentoo.org/attachment.cgi?id=225963 to correctly detect the 
compiler when using -fstack-protector. It patches cleanly over the 
vserver-grsec patched kernel. Full bug report is 
https://bugs.gentoo.org/show bug.cgi?id=312335

My config:
CONFIG CGROUPS=y
# CONFIG CGROUP DEBUG is not set
# CONFIG CGROUP NS is not set
CONFIG CGROUP FREEZER=y
# CONFIG CGROUP DEVICE is not set
CONFIG CGROUP CPUACCT=y
CONFIG CGROUP MEM RES CTLR=y
CONFIG CGROUP MEM RES CTLR SWAP=y
CONFIG CGROUP SCHED=y
CONFIG NET CLS CGROUP=y
CONFIG VSERVER AUTO LBACK=y
# CONFIG VSERVER AUTO SINGLE is not set
# CONFIG VSERVER COWBL is not set
CONFIG VSERVER VTIME=y
# CONFIG VSERVER DEVICE is not set
CONFIG VSERVER PROC SECURE=y
# CONFIG VSERVER HARDCPU is not set
CONFIG VSERVER PRIVACY=y
CONFIG VSERVER CONTEXTS=768
# CONFIG VSERVER WARN is not set
# CONFIG VSERVER DEBUG is not set
CONFIG VSERVER=y
CONFIG GRKERNSEC=y
# CONFIG GRKERNSEC LOW is not set
# CONFIG GRKERNSEC MEDIUM is not set
# CONFIG GRKERNSEC HIGH is not set
CONFIG GRKERNSEC CUSTOM=y
CONFIG GRKERNSEC KMEM=y
CONFIG GRKERNSEC IO=y
CONFIG GRKERNSEC PROC MEMMAP=y
CONFIG GRKERNSEC BRUTE=y
CONFIG GRKERNSEC MODHARDEN=y
CONFIG GRKERNSEC HIDESYM=y
# CONFIG GRKERNSEC KERN LOCKOUT is not set
# CONFIG GRKERNSEC NO RBAC is not set
CONFIG GRKERNSEC ACL HIDEKERN=y
CONFIG GRKERNSEC ACL MAXTRIES=3
CONFIG GRKERNSEC ACL TIMEOUT=30
CONFIG GRKERNSEC PROC=y
# CONFIG GRKERNSEC PROC USER is not set
CONFIG GRKERNSEC PROC USERGROUP=y
CONFIG GRKERNSEC PROC GID=1001
CONFIG GRKERNSEC PROC ADD=y
CONFIG GRKERNSEC LINK=y
CONFIG GRKERNSEC FIFO=y
CONFIG GRKERNSEC SYSFS RESTRICT=y
CONFIG GRKERNSEC ROFS=y
CONFIG GRKERNSEC CHROOT=y
CONFIG GRKERNSEC CHROOT PIVOT=y
CONFIG GRKERNSEC CHROOT CHDIR=y
CONFIG GRKERNSEC CHROOT FCHDIR=y
CONFIG GRKERNSEC CHROOT MKNOD=y
CONFIG GRKERNSEC CHROOT SHMAT=y
CONFIG GRKERNSEC CHROOT UNIX=y
CONFIG GRKERNSEC CHROOT NICE=y
CONFIG GRKERNSEC CHROOT SYSCTL=y
CONFIG GRKERNSEC AUDIT GROUP=y
CONFIG GRKERNSEC AUDIT GID=1007
CONFIG GRKERNSEC EXECLOG=y
CONFIG GRKERNSEC RESLOG=y
CONFIG GRKERNSEC CHROOT EXECLOG=y
CONFIG GRKERNSEC AUDIT PTRACE=y
CONFIG GRKERNSEC AUDIT CHDIR=y
CONFIG GRKERNSEC AUDIT MOUNT=y
CONFIG GRKERNSEC SIGNAL=y
CONFIG GRKERNSEC FORKFAIL=y
CONFIG GRKERNSEC TIME=y
CONFIG GRKERNSEC PROC IPADDR=y
CONFIG GRKERNSEC RWXMAP LOG=y
CONFIG GRKERNSEC AUDIT TEXTREL=y
CONFIG GRKERNSEC EXECVE=y
CONFIG GRKERNSEC DMESG=y
CONFIG GRKERNSEC HARDEN PTRACE=y
CONFIG GRKERNSEC TPE=y
CONFIG GRKERNSEC TPE ALL=y
# CONFIG GRKERNSEC TPE INVERT is not set
CONFIG GRKERNSEC TPE GID=1005
CONFIG GRKERNSEC RANDNET=y
CONFIG GRKERNSEC BLACKHOLE=y
CONFIG GRKERNSEC SOCKET=y
CONFIG GRKERNSEC SOCKET ALL=y
CONFIG GRKERNSEC SOCKET ALL GID=1004
CONFIG GRKERNSEC SOCKET CLIENT=y
CONFIG GRKERNSEC SOCKET CLIENT GID=1003
CONFIG GRKERNSEC SOCKET SERVER=y
CONFIG GRKERNSEC SOCKET SERVER GID=1002
CONFIG GRKERNSEC SYSCTL=y
# CONFIG GRKERNSEC SYSCTL DISTRO is not set
# CONFIG GRKERNSEC SYSCTL ON is not set
CONFIG GRKERNSEC FLOODTIME=10
CONFIG GRKERNSEC FLOODBURST=4
CONFIG PAX PER CPU PGD=y
CONFIG PAX=y
# CONFIG PAX SOFTMODE is not set
CONFIG PAX EI PAX=y
CONFIG PAX PT PAX FLAGS=y
# CONFIG PAX NO ACL FLAGS is not set
CONFIG PAX HAVE ACL FLAGS=y
# CONFIG PAX HOOK ACL FLAGS is not set
CONFIG PAX NOEXEC=y
CONFIG PAX PAGEEXEC=y
# CONFIG PAX EMUTRAMP is not set
CONFIG PAX MPROTECT=y
# CONFIG PAX MPROTECT COMPAT is not set
# CONFIG PAX ELFRELOCS is not set
CONFIG PAX KERNEXEC=y
CONFIG PAX ASLR=y
CONFIG PAX RANDKSTACK=y
CONFIG PAX RANDUSTACK=y
CONFIG PAX RANDMMAP=y
CONFIG PAX MEMORY SANITIZE=y
CONFIG PAX MEMORY STACKLEAK=y
CONFIG PAX MEMORY UDEREF=y
CONFIG PAX REFCOUNT=y
CONFIG PAX USERCOPY=y


-- 
Sandino Araico Sánchez
http://sandino.net



The combined patch against 2.6.32.43 vanilla:
http://sandino.araico.net/parches/vserver/patch-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110.diff
http://sandino.araico.net/parches/vserver/patch-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110.diff.asc

The grsec patch against a vserver-patched kernel:
http://sandino.araico.net/parches/vserver/patch-grsec-2.2.2-201107142110-against-2.6.32.43-vs2.3.0.36.29.7.diff
http://sandino.araico.net/parches/vserver/patch-grsec-2.2.2-201107142110-against-2.6.32.43-vs2.3.0.36.29.7.diff.asc

I have been using this kernel for 3 days in production servers without a reboot.

An important change is a bugfix in PaX where some 32-bit processes were being killed with a SIGBUS
http://forums.grsecurity.net/viewtopic.php?f=3&t=2618
https://bugs.gentoo.org/365915?id=365915

Another patch you might wish to apply is https://bugs.gentoo.org/attachment.cgi?id=225963 to correctly detect the compiler when using -fstack-protector. It patches cleanly over the vserver-grsec patched kernel. Full bug report is https://bugs.gentoo.org/show_bug.cgi?id=312335

My config:
CONFIG_CGROUPS=y
# CONFIG_CGROUP_DEBUG is not set
# CONFIG_CGROUP_NS is not set
CONFIG_CGROUP_FREEZER=y
# CONFIG_CGROUP_DEVICE is not set
CONFIG_CGROUP_CPUACCT=y
CONFIG_CGROUP_MEM_RES_CTLR=y
CONFIG_CGROUP_MEM_RES_CTLR_SWAP=y
CONFIG_CGROUP_SCHED=y
CONFIG_NET_CLS_CGROUP=y
CONFIG_VSERVER_AUTO_LBACK=y
# CONFIG_VSERVER_AUTO_SINGLE is not set
# CONFIG_VSERVER_COWBL is not set
CONFIG_VSERVER_VTIME=y
# CONFIG_VSERVER_DEVICE is not set
CONFIG_VSERVER_PROC_SECURE=y
# CONFIG_VSERVER_HARDCPU is not set
CONFIG_VSERVER_PRIVACY=y
CONFIG_VSERVER_CONTEXTS=768
# CONFIG_VSERVER_WARN is not set
# CONFIG_VSERVER_DEBUG is not set
CONFIG_VSERVER=y
CONFIG_GRKERNSEC=y
# CONFIG_GRKERNSEC_LOW is not set
# CONFIG_GRKERNSEC_MEDIUM is not set
# CONFIG_GRKERNSEC_HIGH is not set
CONFIG_GRKERNSEC_CUSTOM=y
CONFIG_GRKERNSEC_KMEM=y
CONFIG_GRKERNSEC_IO=y
CONFIG_GRKERNSEC_PROC_MEMMAP=y
CONFIG_GRKERNSEC_BRUTE=y
CONFIG_GRKERNSEC_MODHARDEN=y
CONFIG_GRKERNSEC_HIDESYM=y
# CONFIG_GRKERNSEC_KERN_LOCKOUT is not set
# CONFIG_GRKERNSEC_NO_RBAC is not set
CONFIG_GRKERNSEC_ACL_HIDEKERN=y
CONFIG_GRKERNSEC_ACL_MAXTRIES=3
CONFIG_GRKERNSEC_ACL_TIMEOUT=30
CONFIG_GRKERNSEC_PROC=y
# CONFIG_GRKERNSEC_PROC_USER is not set
CONFIG_GRKERNSEC_PROC_USERGROUP=y
CONFIG_GRKERNSEC_PROC_GID=1001
CONFIG_GRKERNSEC_PROC_ADD=y
CONFIG_GRKERNSEC_LINK=y
CONFIG_GRKERNSEC_FIFO=y
CONFIG_GRKERNSEC_SYSFS_RESTRICT=y
CONFIG_GRKERNSEC_ROFS=y
CONFIG_GRKERNSEC_CHROOT=y
CONFIG_GRKERNSEC_CHROOT_PIVOT=y
CONFIG_GRKERNSEC_CHROOT_CHDIR=y
CONFIG_GRKERNSEC_CHROOT_FCHDIR=y
CONFIG_GRKERNSEC_CHROOT_MKNOD=y
CONFIG_GRKERNSEC_CHROOT_SHMAT=y
CONFIG_GRKERNSEC_CHROOT_UNIX=y
CONFIG_GRKERNSEC_CHROOT_NICE=y
CONFIG_GRKERNSEC_CHROOT_SYSCTL=y
CONFIG_GRKERNSEC_AUDIT_GROUP=y
CONFIG_GRKERNSEC_AUDIT_GID=1007
CONFIG_GRKERNSEC_EXECLOG=y
CONFIG_GRKERNSEC_RESLOG=y
CONFIG_GRKERNSEC_CHROOT_EXECLOG=y
CONFIG_GRKERNSEC_AUDIT_PTRACE=y
CONFIG_GRKERNSEC_AUDIT_CHDIR=y
CONFIG_GRKERNSEC_AUDIT_MOUNT=y
CONFIG_GRKERNSEC_SIGNAL=y
CONFIG_GRKERNSEC_FORKFAIL=y
CONFIG_GRKERNSEC_TIME=y
CONFIG_GRKERNSEC_PROC_IPADDR=y
CONFIG_GRKERNSEC_RWXMAP_LOG=y
CONFIG_GRKERNSEC_AUDIT_TEXTREL=y
CONFIG_GRKERNSEC_EXECVE=y
CONFIG_GRKERNSEC_DMESG=y
CONFIG_GRKERNSEC_HARDEN_PTRACE=y
CONFIG_GRKERNSEC_TPE=y
CONFIG_GRKERNSEC_TPE_ALL=y
# CONFIG_GRKERNSEC_TPE_INVERT is not set
CONFIG_GRKERNSEC_TPE_GID=1005
CONFIG_GRKERNSEC_RANDNET=y
CONFIG_GRKERNSEC_BLACKHOLE=y
CONFIG_GRKERNSEC_SOCKET=y
CONFIG_GRKERNSEC_SOCKET_ALL=y
CONFIG_GRKERNSEC_SOCKET_ALL_GID=1004
CONFIG_GRKERNSEC_SOCKET_CLIENT=y
CONFIG_GRKERNSEC_SOCKET_CLIENT_GID=1003
CONFIG_GRKERNSEC_SOCKET_SERVER=y
CONFIG_GRKERNSEC_SOCKET_SERVER_GID=1002
CONFIG_GRKERNSEC_SYSCTL=y
# CONFIG_GRKERNSEC_SYSCTL_DISTRO is not set
# CONFIG_GRKERNSEC_SYSCTL_ON is not set
CONFIG_GRKERNSEC_FLOODTIME=10
CONFIG_GRKERNSEC_FLOODBURST=4
CONFIG_PAX_PER_CPU_PGD=y
CONFIG_PAX=y
# CONFIG_PAX_SOFTMODE is not set
CONFIG_PAX_EI_PAX=y
CONFIG_PAX_PT_PAX_FLAGS=y
# CONFIG_PAX_NO_ACL_FLAGS is not set
CONFIG_PAX_HAVE_ACL_FLAGS=y
# CONFIG_PAX_HOOK_ACL_FLAGS is not set
CONFIG_PAX_NOEXEC=y
CONFIG_PAX_PAGEEXEC=y
# CONFIG_PAX_EMUTRAMP is not set
CONFIG_PAX_MPROTECT=y
# CONFIG_PAX_MPROTECT_COMPAT is not set
# CONFIG_PAX_ELFRELOCS is not set
CONFIG_PAX_KERNEXEC=y
CONFIG_PAX_ASLR=y
CONFIG_PAX_RANDKSTACK=y
CONFIG_PAX_RANDUSTACK=y
CONFIG_PAX_RANDMMAP=y
CONFIG_PAX_MEMORY_SANITIZE=y
CONFIG_PAX_MEMORY_STACKLEAK=y
CONFIG_PAX_MEMORY_UDEREF=y
CONFIG_PAX_REFCOUNT=y
CONFIG_PAX_USERCOPY=y


-- 
Sandino Araico Sánchez 
http://sandino.net