Subject: Re: [vserver] CVE-2016-10229: MSG_PEEK - URGENT patch needed
From: Corey Wright <undefined@pobox.com>
Date: Thu, 4 May 2017 08:12:14 -0500

On Tue, 2 May 2017 07:58:58 -0500
Corey Wright <undefined@pobox.com> wrote:

> On Tue, 02 May 2017 10:13:58 +0100
> Ben Green <ben@bristolwireless.net> wrote:
> 
> > Quoting Herbert Poetzl <herbert@13thfloor.at>:
> > 
> > >> No reason other than it would be good for everyone to
> > >> have it and I'm not sure how to create the Deb files
> > >> like you do.
> > >
> > > I'm not creating any deb files, but I'm not Ben either ...
> > >
> > > And I'm certainly not speaking for him, but I think that
> > > if you use his packages on a regular basis and kind of
> > > 'depend' on them being up-to-date, you might consider
> > > asking nicely for an update or maybe even donate something
> > > to say thanks ...
> > 
> > Hi all,
> > 
> > I'd like a patched kernel too. I'm more than happy to compile a kernel  
> > and patchset that I'm given. The job of checking the patch against the  
> > vserver patched kernel is not one I'm keen to take on. I am very busy  
> > at the moment. If someone can confirm that the patch works for a  
> > vserver patched kernel, then the job of compiling, and a quick test of  
> > the result, is one I'm happy to take on.
> 
> i'm running 3.18.50-vs2.3.7.5 and will put into production
> 3.18.51-vs2.3.7.5 later this week, having already tested it.
> 
> my testing consists of testme.sh, testfs.sh (with ext[234]), and
> creating a basic set of device files (eg null, ptmx, random, tty,
> urandom) within a vserver where device permissions are enforced by
> cgroup's devices.{allow,deny} (which is a use-case that silently broke
> with a previous linux-vserver + upstream update iteration, so i added
> it as a check-out test.)
> 
> still need to figure out why jessie lxc containers can only use a
> single tty and only once (eg can't log into container twice
> successively or simultaneously), but that happens on vanilla 3.18,
> too.  (need to try switching the container's init from systemd to sysv
> the next time i experiment/debug.)

tl;dr i have encountered no problems with 3.18.51-vs2.3.7.5 even with regard
to running lxc containers.

in case anybody cares in follow-up (or is interested in running lxc
containers on 3.18.51-vs2.3.7.5)...

the problem was systemd running in a jessie lxc container without
systemd running on the wheezy host, a known problem [1] (which i figured
and hinted at above based on systemd's known self-centeredness ;).
wheezy->jessie host upgrading is on the todo (especially as stretch
approaches).

[1] https://www.debian.org/releases/stable/amd64/release-notes/ch-information.en.html#issues-lxc-wheezy-host

corey
--
undefined@pobox.com

> corey
> --
> undefined@pobox.com
> 
> > Donations always appreciated.
> > 
> > Cheers,
> > Ben