The first stable OpenVZ release
Posted Dec 18, 2005 10:14 UTC (Sun) by
dev (guest, #34359)
In reply to:
The first stable OpenVZ release by PaXTeam
Parent article:
The first stable OpenVZ release
Sorry for delay.
Sure, we can't prevent exploiting kernel bugs at all. All we can do is to add some barriers which would require special knowledge and efforts to overcome them.
Some of them are: d_root_check(), check_area_XXX() which try to prevent access to files 100% not belonging to the user.
another idea which you brought to me with your message - is to extend vps_dumble flag (which is another security extension, preventing host process to be dumpable when it "entered" the VPS), so that process from host system would always stay undumpable for VPS, not on "enter" only.
If you have some other ideas on security, I will be glad to discuss it and hear you opinion on this topic. Probably it's better if we move to devel at openvz dottt org what do you think?
(
Log in to post comments)
