Re: 2.4.20-4.15 anytime soon?

On Saturday 12 June 2004 17:40, ian sison (mailing list) wrote:

Hi Ian,

> > http://www.kernel.org/pub/linux/kernel/people/mcp/tmp/2.4-WOLK-CHANGELOG
> Holy mother of .... This has got to be the best WOLK ever! :)

:-) ... Indeed, it is. I am very proud. Say thanks to a big fat customer of my 
company who sponsored most of it :)


> Any advantages for considering grsec 2 over 1.x ?  Incomptibilities?
> Maybe i should hop on over to the grsec website instead...

hehe, well, the website may explain it better than I can :) ... But as 
2.4-WOLK is a stable series kernel tree, I can't change grsec from 1 to 2 per 
default as I am sure I'll break a lot of users who have ACL sets for grsec1 
in production. For all the others I offer the broken out patch of grsec2 :)

One prolly good thing of grsec2 is the full learning system. It still needs 
lot of work, especially the gradm2 part when reducing learned log to an ACL 
set but hey, Brad is working on this :)

Anyway, grsec1 and grsec2 are incompatible in the ACL language. If you have a 
working ACL set for grsec1 you have to rewrite much of those to fit grsec2 
ACL language and one major issue is, imho, you can't include acl files, let's 
say (some snip of my grsec1 acl set):



##############
# Proc ACL's #
##############                  

#: Daemons
include </etc/grsec/includes/daemons>

#: Network-Daemons              
include </etc/grsec/includes/network-daemons>

#: Programs
include </etc/grsec/includes/programs>


This won't work with grsec2. You have to put every single ACL rule into one 
single file. It might be trivial to re-add this functionality to gradm2. 
Let's see if some spare time comes up ...

.oO( I still don't get it why Brad removes good features in every new version, 
thinking about fork bomb protection, tty/pts root login restrictions and holy 
shitload more things )Oo.

ciao, Marc


-------------------------------------------------------
This SF.Net email is sponsored by the new InstallShield X.
From Windows to Linux, servers to mobile, InstallShield X is the
one installation-authoring solution that does it all. Learn more and
evaluate today! http://www.installshield.com/Dev2Dev/0504
_______________________________________________
WOLK - Working Overloaded Linux Kernel
[email protected]
https://lists.sourceforge.net/lists/listinfo/wolk-devel