Subject: Re: [vserver] vserver+grsecurity or PaX?
From: Zbyniu Krzystolik <zbyniu@pld-linux.org>
Date: Fri, 15 Feb 2008 17:04:54 +0100

Mniej wiecej Thu, Feb 14, 2008 at 10:10:10AM +0100, zainteresowany Natanael Copa rzekl:
> Hi,
> 
> I have been thinking lately of the grsecury patch. There are many
> features in grsecurity that is redundant or does not really work very
> well with vserver.

What features don't work?

> Does RBAC really work in a vserver? Can you set up policies for each
> vserver? I doubt it and if not, the RBAC is pretty useless.

Yes, of course it works. RBAC knows nothing that process in inside
vserver (doesn't care about XID and NID), it is only process, isolated,
not virtualized. So if you use vservers in classic configuration (with
chroots), you just need prefix subjects and objects with /vservers/<name>.

Simple example:

subject /vservers o
        /       h

subject /vservers/www/bin
        /vservers
        /vservers/www/bin       rx                                               
        /vservers/www/etc       rx
        /vservers/www/lib       rxi
	[...]

First problem here is to manage such policy, it is not pretty readable.

Other thing is vhashify - if you use it RBAC will refuse policy because
of hard links. For existing files grsec uses inodes, there will be
posibility to create duplicates in policy what is prohibited.

> grsecurity also provides some features to prevent escaping from a
> chroot. A vserver is a chroot and has its own mechanism to prevent
> escaping. So I think the additiona features provided in grsecurity
> should be added to vserver if they are needed.

But where is the problem? Two projects provides independent
implementations of similar functionality. If used together must be
configured with caution. That's all.

> So whats left in grsecurity? The extra logging. Not very useful for
> vservers (logs be very easily flooded)

Logging can be turned on only for some existences, like signals, mounts
or for group.

Grsecurity provides also proc restrictions func, which you may want
inside vserver (and yes - it works fine), TPE likewise.

> So whats left is basicly Pax which makes really sense to have. There is
> a separate patch for PaX only which is updated more often than the full
> grsecurity patch.
> 
> Might be an idea to combine vserver+pax rather than vserver+grsecurity?

There is not problem to create vserver+pax.

Also not problem to use vserver+grsec(with rbac)+pax, I have such
configurations.

Zbyniu
-- 
%% Absolutely nothing we trust %%