Re: [gentoo-hardened] virtualization with gentoo hardened

[Yiannis]

On Tue, 11 Aug 2009 16:55:18 +0100
Ed W <lists@××××××××××.com> wrote:

> Yiannis wrote:
> > Hello,
> >
> > I am running hardened gentoo with the toolchain provided by the
> > xake-toolchain overlay. I am looking for a way to use virtualization
> > with my current config. I am aware of linux-vserver project which
> > has grsecurity integration, but as far as I remember does not play
> > well with rbac. Anyone that has a similar working config?
> >
>
> I use hardened host (2.6.29) with vserver.  Under this I run hardened
> guests.  All of these are old style hardened (gcc 3.4.6, not the new
> gcc4 stuff. (As an aside, even uclibc+patches now seems to work ok on
> gcc4.4.1 + hardened, so I think it's about time we had a push to try
> and get the hardened profile to shuffle along a bit...)
>
> I am not currently using the RBAC features of grsec, but I don't
> immediately see a reason why they wouldn't work.... I guess it's
> possible they would need to be implemented in the host rather than
> the guest (which would feel a bit wierd), but it should still work I
> guess...
>
> All other hardenings seem to work as advertised and generally
> speaking vserver is a nice lightweight, pseudo virtualisation which
> is often good enough for your needs... It's really just a slightly
> more fancy chroot system with some scripts around it and some
> additional hardening (and all the associated limitations).  Xen, etc
> are the way you want to go if you need full isolation.  However,
> vserver allows you to more neatly overcommit machine resources and
> has a number of other advantages
>
> Good luck
>
> Ed W

Hello Ed,

I used to have a box with the same setup as yours. As far as I remember
I had some difficulties on applying policies on guests from host. I
think I have seen an old patch on linux-vserver.org site for gradm
providing this functionality but it was posted some years ago.
It was abandoned and at a primitive state so I didn't bother trying it. 
The past two days I have been trying out lguest(with no luck yet) as an
alternative to kvm, since my pc's are not vt-x capable. The reason that
I prefer lguest(if it finally works) and kvm is that they are both in
mainline kernel, let alone the full isolation that you mentioned. While
googling a bit I read an article on ibm's site about linux containers
(LXC) which is supposed to finally land on the kernel. I think that this
might be worth trying as opposed to linux-vserver.