well, i thought about it a bit, looked at some stuff... i never used the rbac myself, so i can't comment on that, but i can comment on the other grsecurity features... like deny priviledged IO calls, deny writes to /dev/kmem etc.. remove the addresses in /proc/<pid>/maps (which you could use to determine offsets for you exploits) hiding of kernel symbols etc... imho these are quite useful, and i don't see any reason why NOT to have them. i know that the pax team follows the kernel more closely, but since there is no vserver for 2.6.24+, it's not very useful... especially at this moment. normally, spender fixes a patch quite closely to the pax releases. when he doesn't, i just update the grsecurity patch with the pax patches from later "realeases" (I discuss them with the pax team what the updates do, checkout the diffs, see if there are important fixes etc...). in this way, we have "the latest of pax" and the grsec features, combined with vserver and it's most recent supported kernel. greetings, On Thu, 2008-02-14 at 10:10 +0100, Natanael Copa wrote: > Hi, > > I have been thinking lately of the grsecury patch. There are many > features in grsecurity that is redundant or does not really work very > well with vserver. > > Does RBAC really work in a vserver? Can you set up policies for each > vserver? I doubt it and if not, the RBAC is pretty useless. > > grsecurity also provides some features to prevent escaping from a > chroot. A vserver is a chroot and has its own mechanism to prevent > escaping. So I think the additiona features provided in grsecurity > should be added to vserver if they are needed. > > So whats left in grsecurity? The extra logging. Not very useful for > vservers (logs be very easily flooded) > > So whats left is basicly Pax which makes really sense to have. There is > a separate patch for PaX only which is updated more often than the full > grsecurity patch. > > Might be an idea to combine vserver+pax rather than vserver+grsecurity? > > -nc Disclaimer: http://www.kuleuven.be/cwis/email_disclaimer.htm