Subject: Re: [vserver] vserver+grsecurity or PaX?
From: Rik Bobbaers <rik.bobbaers@cc.kuleuven.be>
Date: Fri, 15 Feb 2008 11:28:02 +0100

well,

i thought about it a bit, looked at some stuff...
i never used the rbac myself, so i can't comment on that, but i can
comment on the other grsecurity features...

like deny priviledged IO calls,
deny writes to /dev/kmem etc..
remove the addresses in /proc/<pid>/maps (which you could use to
determine offsets for you exploits)
hiding of kernel symbols

etc...
imho these are quite useful, and i don't see any reason why NOT to have
them.

i know that the pax team follows the kernel more closely, but since
there is no vserver for 2.6.24+, it's not very useful... especially at
this moment. normally, spender fixes a patch quite closely to the pax
releases. when he doesn't, i just update the grsecurity patch with the
pax patches from later "realeases" (I discuss them with the pax team
what the updates do, checkout the diffs, see if there are important
fixes etc...). in this way, we have "the latest of pax" and the grsec
features, combined with vserver and it's most recent supported kernel.

greetings,

On Thu, 2008-02-14 at 10:10 +0100, Natanael Copa wrote:
> Hi,
> 
> I have been thinking lately of the grsecury patch. There are many
> features in grsecurity that is redundant or does not really work very
> well with vserver.
> 
> Does RBAC really work in a vserver? Can you set up policies for each
> vserver? I doubt it and if not, the RBAC is pretty useless.
> 
> grsecurity also provides some features to prevent escaping from a
> chroot. A vserver is a chroot and has its own mechanism to prevent
> escaping. So I think the additiona features provided in grsecurity
> should be added to vserver if they are needed.
> 
> So whats left in grsecurity? The extra logging. Not very useful for
> vservers (logs be very easily flooded)
> 
> So whats left is basicly Pax which makes really sense to have. There is
> a separate patch for PaX only which is updated more often than the full
> grsecurity patch.
> 
> Might be an idea to combine vserver+pax rather than vserver+grsecurity?
> 
> -nc



Disclaimer: http://www.kuleuven.be/cwis/email_disclaimer.htm