[SOLVED] Is it possible to multi-patch a kernel ?

lalebarde · Last edited by lalebarde on Tue Nov 09, 2010 3:38 pm; edited 1 time in total

Hi all,
I would like to patch my kernel with :
- xen because I need to build some virtual server.
- xenomai because I need real time and it is the solution of my choice.
- tuxonice because I want to be able to suspend my desktop and save the planet with energy saving (my pwer-manager is set to 10').
- hardened to possibly put my virtual server in production with maximum of security for my desktop. Further, is it required on the host ?
Is it easily doable ? What is the recpommended method ? As far as I know, patches are not available for every gentoo-sources releases.

xen :
(2.6.18-r12) 2.6.18-r12!b!s
(2.6.34-r3) ~2.6.34-r3!b!s
(2.6.34-r4) ~2.6.34-r4!b!s

xenomai :
http://www.xenomai.org/index.php/FAQs : "you may use any I-pipe patch for any kernel version ranging from 2.4.35/i386 to 2.6.29.4/x86."

tuxonice :
(2.6.32-r17) 2.6.32-r17!b!s
(2.6.32-r18) ~2.6.32-r18!b!s
(2.6.32-r19) ~2.6.32-r19!b!s
(2.6.34-r6) 2.6.34-r6!b!s
(2.6.34-r7) ~2.6.34-r7!b!s
(2.6.34-r

~2.6.34-r8!b!s
(2.6.35-r3) ~2.6.35-r3!b!s
(2.6.35-r4) ~2.6.35-r4!b!s
(2.6.35-r5) ~2.6.35-r5!b!s
(2.6.35-r6) ~2.6.35-r6!b!s
(2.6.36) ~2.6.36!b!s

hardened
(2.6.28-r9) 2.6.28-r9!b!s
(2.6.32-r9) 2.6.32-r9!b!s
(2.6.32-r22) 2.6.32-r22!b!s
(2.6.32-r23) ~2.6.32-r23!b!s
(2.6.34-r6) 2.6.34-r6!b!s
(2.6.35-r4) ~2.6.35-r4!b!s
(2.6.35-r5) ~2.6.35-r5!b!s

If I assume a 2.6.34-r6 the best fit, how to proceed ?

aCOSwt

lalebarde · Last edited by lalebarde on Fri Nov 05, 2010 6:05 pm; edited 1 time in total

chithanh · Posted: Fri Nov 05, 2010 4:45 pm Post subject:

I don't think this is a particularly clever combination of patches. Real-time and security are often conflicting goals. Also if someone finds a vulnerability in the Xen hypervisor, your oh-so-secure hardened might come crashing down.

If isolation between server and desktop is a priority, then I would suggest to run the server in QEMU with its own user account.

lalebarde · Posted: Fri Nov 05, 2010 6:10 pm Post subject:

chithanh · Posted: Fri Nov 05, 2010 7:31 pm Post subject:

When running QEMU as user, you have two layers of separation between an attacker inside the VM and the host. The attacker would need to both break out of the VM and perform a local privilege escalation to take control of the host.

If you run QEMU as root or use something kernel-based like KVM, Xen, etc. then compromising the hypervisor would be enough.

DaggyStyle · Watchman Joined: 22 Mar 2006 Posts: 5945

lalebarde

lalebarde · Posted: Fri Nov 05, 2010 8:45 pm Post subject:

eccerr0r · Posted: Sun Nov 07, 2010 8:31 pm Post subject:

Offtopic section:

Know what... after thinking about this a bit, if the person running the VM never notices an issue with the VM and the 0wn3d VM continues to be 0wn3d, then does it really matter if the physical host gets compromised or not? They still control a portion of your machine... network and all. If you can do anything useful with the VM then the hacker has succeeded in getting what they wanted (store files? access network? botnet? these three things tend to still be possible *inside* the VM). Even worse if the intent of each VM was supposed to replace a real machine, they can still do what they could do on a real machine, to the network specifically.

Granted cleaning it up is a matter of replacing the image of the VM, but if you had data that you want to save in the VM... then it could just be as messy as a physical machine. The good thing is the disk damage is contained... but network? that's shared!

Word of warning to users believing virtual machines is a security panacea... it's not! Sorry, still have to secure each individual VM!

Sorry, I maintain my machine and am tired of all these botnet machines around... just wanted to spread the vigilante for people to watch their machines, virtual or not... please don't let your/a (virtual) machine be part of their collective...

Ontopic section:

With patches, people have not verified that each patch will work with another. Results are not guaranteed and likely they will interfere with each other. Unless you're a seasoned kernel hacker that can fix these locking/semaphore issues between subsystems, likely even if it will compile at all, may end up with race conditions leading to insecurity or inexplicable crashes.

Soapbox section:

24/7 servers weren't meant to be suspended and power savings via suspend should be jettisoned if push comes to shove...
_________________
Intel Core i7 2700K/Radeon R7 250/24GB DDR3/256GB SSD
What am I supposed watching?

chithanh · Posted: Mon Nov 08, 2010 9:30 pm Post subject:

eccerr0r · Posted: Mon Nov 08, 2010 10:20 pm Post subject:

See the problem with suspend on servers:

It's still going to be down for the duration, isn't it? And any active net connections to it will be stopped? To me, the difference between suspended and reboot is not going to make much of a difference, plus the potential for machine state corruption while the machine is suspended, adding risk to reliability.

Again this is just an opinion, if people really want to suspend servers so be it, it might save a few seconds/minutes boot time out of the availability.

Remember, for 24/7 servers, boot time quickly adds up from the hundreds of times UPSes need service and physical machines need to be moved...
_________________
Intel Core i7 2700K/Radeon R7 250/24GB DDR3/256GB SSD
What am I supposed watching?

lalebarde · Posted: Tue Nov 09, 2010 3:37 pm Post subject:

Thanks a lot all for your answers.
Concerning my kernel first question, I keep tuxonice kernel with kvm enabled that I will patch with xenomai (for my development PC - so hardened is useless).
For production, I will use qemu without kvm with a dedicated user or a dedicated hardware. I won't get hosting until it pays for it.

aCOSwt

lalebarde