lvs fullnat部署手冊（四）相關配置篇

1、內核提權

   因爲目前fullnat用的內核是2.6.32-220.23.1.e16這個版本。最近存在內核提權的漏洞。此次受影響的存在於centos6中除了6.5的全部系統。

   烏雲上已經公佈了http://zone.wooyun.org/content/3733

   解決的辦法是：

sysctl kernel.perf_event_paranoid=2
       並寫到/etc/sysctl.conf

   關於kernel.perf_event_paranoid：

kernel.perf_event_paranoid = 2: you can't take any measurements. The perf utility might still be useful to analyse existing records with perf ls, perf report, perf timechart or perf trace.
kernel.perf_event_paranoid = 1: you can trace a command with perf stat or perf record, and get kernel profiling data.
kernel.perf_event_paranoid = 0: you can trace a command with perf stat or perf record, and get CPU event data.
kernel.perf_event_paranoid = -1: you get raw access to kernel tracepoints (specifically, you can mmap the file created by perf_event_open, I don't know what the implications are).

   若是想直接打到內核中，修改kernel/events/core.c，找到int sysctl_perf_event_paranoid在最後改爲2。而後搭乘patch，作成內核rpm包

2、待續