Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 17 Nov 2016 14:32:13 +0100
From: Solar Designer <solar@...nwall.com>
To: Alan Williams <ajw@...blue.net.au>
Cc: owl-users@...ts.openwall.com
Subject: Re: How can I upgrade this against C.O.W. on Owls with kernel version  2.6.18-194.11.3.el5.028stab071.5.owl1

Hi Alan,

On Thu, Nov 17, 2016 at 05:02:59PM +1100, Alan Williams wrote:
> I have found a number of owl installs in the infrastructure I now manage and
> I am wondering how to deal with them in respect of the dirty c.o.w.
> vulnerability,  given that they are all quite old.
> 
> The four machines list the following two kernel versions:
> 
> 2.6.18-194.11.3.el5.028stab071.5.owl1 #1 SMP Sat Sep 25 02:43:36 MSD 2010
> x86_64 GNU/Linux
> 
> 2.6.18-348.3.1.el5.028stab106.2.owl1 #1 SMP Mon Apr 8 03:39:13 MSK 2013
> x86_64 GNU/Linux

Our kernel packages from Owl 3.1-stable should install and work in
replacement of the above.  (The packages from Owl-current are
essentially the same, and might also work for you, but they require
Owl 3.0+'s support of xz compression in RPM, so won't install on pre-3.0
systems.  I don't know how old the userlands on your machines are, so
going with 3.1-stable's packages is a safer bet.)

You may download them from here:

https://mirrors.kernel.org/openwall/Owl/3.1-stable/x86_64/RPMS/

2.6.18-408.el5.028stab120.1.owl4 is the version you currently need, or
whatever will be latest by the time you approach these upgrades.

We have some instructions here:

http://openwall.info/wiki/Owl/upgrade#Upgrade-the-kernel

When upgrading the machines with the -194 kernel, please note this change:

* Sun Oct 09 2011 Solar Designer <solar-at-owl.openwall.com> 2.6.18-274.3.1.el5.028stab094.3.owl1
[...]
- Moved some OpenVZ features to modules like it is done in OpenVZ's official
kernel builds.

This means that if you use OpenVZ containers on that machine, you need
to also upgrade vzctl, for this change:

* Sun Oct 09 2011 Solar Designer <solar-at-owl.openwall.com> 3.0.23-owl7
- No longer set MODULES_DISABLED=yes in the default config since our new
kernels use modules for OpenVZ stuff just like OpenVZ's official kernels do.

and make sure /etc/vz/vz.conf gets updated accordingly (or just edit it
manually).

I hope this helps.

Alexander

Powered by blists - more mailing lists

Your e-mail address:

Powered by Openwall GNU/*/Linux - Powered by OpenVZ