Security - Revision history

Sergey Bronnikov: add link to security report

2015-11-16T10:02:34Z

add link to security report

Kir: only stable kernels are rhel-based

2012-06-21T08:32:38Z

only stable kernels are rhel-based

Kir: updated

2012-06-21T08:32:09Z

updated

71.192.160.118: 2.6.18, not 2.6.8; minor grammar/spelling throughout

2010-05-20T21:41:29Z

2.6.18, not 2.6.8; minor grammar/spelling throughout

DanielQuinn: /* Audit */

2008-07-02T21:35:07Z

‎Audit

Kir: created

2006-06-13T13:50:25Z

created

New page

For the project such as OpenVZ, security of the software is of paramount importance. This is how we assure that OpenVZ is secure.

== Kernel ==
The OpenVZ kernel is based on the Linux kernel. OpenVZ team is tracking and analyzing all the security updates to the Linux kernel and applies them accordingly.

Note that current stable kernel branch is based on 2.6.8 kernel, which is quite old. This is done to achieve maximum possible security and stability. By using the older kernel, we do neither add new bugs nor security holes, but the old bugs and holes are getting discovered and fixed, and the kernel matures. Big vendors such as Novell and Red Hat are doing the same for their enterprise Linux offerings: for example, Red Hat Enterprise Linux 4 is based on kernel 2.6.9.

== Audit ==
OpenVZ has undergone a throughtout security audit performed by Solar Designer in winter 2005. He found a single issue in OpenVZ kernel code and a couple of issues in mainstream Linux kernel code — all of them there fixed, mainstream fixes were sent to LKML.

[[Category: Security]]
[[Category: Kernel]]

@@ Line 4: / Line 4: @@
 The OpenVZ kernel is based on the Linux kernel. The OpenVZ team tracks and analyzes all the security updates to the Linux kernel and applies them accordingly.
-To achieve the maximum possible security and stability, OpenVZ kernels are based on Red Hat Enterprise Linux kernels, which are conservative and well-maintained. By using an enterprise kernel as a base (rather than latest vanilla kernel), we avoid adding new bugs or security holes, still the old ones are getting discovered and fixed, and the kernel matures.
+To achieve the maximum possible security and stability, stable OpenVZ kernels are based on Red Hat Enterprise Linux kernels, which are conservative and well-maintained. By using an enterprise kernel as a base (rather than latest vanilla kernel), we avoid adding new bugs or security holes, still the old ones are getting discovered and fixed, and the kernel matures.
 == Audit ==

@@ Line 1: / Line 1: @@
-For a project such as OpenVZ, security of the software is of paramount importance. This is how we assure that OpenVZ is secure.
+For a project such as OpenVZ, security of the software is of paramount importance. Let's explain how we assure that OpenVZ is secure.
 == Kernel ==
 The OpenVZ kernel is based on the Linux kernel. The OpenVZ team tracks and analyzes all the security updates to the Linux kernel and applies them accordingly.
-Note that the current stable kernel branch is based on the 2.6.18 kernel, which is quite old. This is done to achieve the maximum possible security and stability. By using an older kernel, we avoid adding new bugs or security holes, but the old bugs and holes are getting discovered and fixed, and the kernel matures. Big vendors such as Novell and Red Hat do the same for their enterprise Linux offerings: for example, Red Hat Enterprise Linux 4 is based on kernel 2.6.9.
+To achieve the maximum possible security and stability, OpenVZ kernels are based on Red Hat Enterprise Linux kernels, which are conservative and well-maintained. By using an enterprise kernel as a base (rather than latest vanilla kernel), we avoid adding new bugs or security holes, still the old ones are getting discovered and fixed, and the kernel matures.
 == Audit ==

@@ Line 2: / Line 2: @@
 == Kernel ==
 The OpenVZ kernel is based on the Linux kernel. The OpenVZ team tracks and analyzes all the security updates to the Linux kernel and applies them accordingly.
@@ Line 7: / Line 8: @@
 == Audit ==
 OpenVZ has undergone a thorough security audit, performed by Solar Designer in winter 2005. He found a single issue in OpenVZ kernel code and a couple of issues in mainstream Linux kernel code &mdash; all of them were fixed, and the mainstream fixes were sent to the LKML.
 [[Category: Security]]
 [[Category: Kernel]]