PCI-DSS Compliance

[marotori]

Right.. I have hit a rather frustrating problem that I am pretty certain is going to affect ALLOT of people.

My latest PCI compliancy scans on one of my servers threw up a problem.

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-1146

It seems the kernel 2.6 series of linux (all flavours) has a flaw in it. As a result, PCI compliancy is being denied.

Whats the problem with this?

If you run anything in a container, you get kernel 2.6.32.XX from the guest machine.

Result.

If you run openVZ containers, you have no way of getting PCI-DSS compliance!

Dont know if anyone has any magic fixes to this issue?

Rob

 

[e100]

As best I can this vulnerability requires that the kernel is compiled with CONFIG_CGROUPS=y
Not all distributions have this enabled so using KVM virtualization with a distro that has this option disabled should be enough to get around this problem.

The Proxmox kernel does have this option enabled.
So it is indeed an issue for Proxmox and openvz containers.

I see no bugs on openvz bugzilla related to this.
openvz pulls kernel from RedHat, their bug basically states that CGROUPS are disabled therefore it is not an issue:
https://bugzilla.redhat.com/show_bug.cgi?id=800813

Can we disable CGROUPS in Proxmox to address this? I assume that maybe openvz needs them but I really have no idea.
If CGROUPS are needed then Proxmox or openvz will need to backport a patch to fix this.

 

[udo]

As best I can this vulnerability requires that the kernel is compiled with CONFIG_CGROUPS=y
Not all distributions have this enabled so using KVM virtualization with a distro that has this option disabled should be enough to get around this problem.

The Proxmox kernel does have this option enabled.
So it is indeed an issue for Proxmox and openvz containers.

I see no bugs on openvz bugzilla related to this.
openvz pulls kernel from RedHat, their bug basically states that CGROUPS are disabled therefore it is not an issue:
https://bugzilla.redhat.com/show_bug.cgi?id=800813

Can we disable CGROUPS in Proxmox to address this? I assume that maybe openvz needs them but I really have no idea.
If CGROUPS are needed then Proxmox or openvz will need to backport a patch to fix this.

Hi,
I think CGROUPS are an important tool so I hope it's don't need to be disabled in PVE.

Udo

 

[marotori]

What are they used for?

I just hope an easy solution exists


Rob


Sent from my iPhone using Tapatalk

 

[dietmar]

Please can you report a bug at bugzilla.openvz.org?