Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 31 Jul 2012 21:52:46 +0400
From: Vasily Kulikov <segoon@...nwall.com>
To: owl-dev@...ts.openwall.com
Subject: vzctl bitness_lock patch

Hi,

The patch for bitness_lock feature is attached.

It seems vzctl needs only BITNESS_LOCK_ON_EXEC, BITNESS_LOCK (just lock
current process) is not needed.  I suppose we can even lock CT after it
is started without bitness locking using CPT and restarting each process
(I didn't investigate whether it is actually true, though).  E.g. CPT
on modern upstream kernel is implemented in userspace by recreating the
whole process tree, where it is trivially to add prctl() before
executing the actual restorer.

Thanks,

-- 
Vasily

View attachment "vzctl-3.0.23-owl-BITNESS_LOCK.diff" of type "text/x-diff" (7861 bytes)

Powered by blists - more mailing lists

Your e-mail address:

Powered by Openwall GNU/*/Linux - Powered by OpenVZ