Re: [gentoo-hardened] Fwd: hardened gentoo mailman/postfix/apache notes?

On Thursday 03 January 2008 00:19:27, brant williams wrote：
> You should recompile your kernel and choose a different gid for tpe
> (anything above 1024 would be a good choice).  Alternatively, you could
> turn the feature off.  ;)

make sense, but using sysctl is ok since I've enable the sysctl features under 
grsecurity, should be something like:

sysctl -w kernel.grsecurity.tpe=0

Thanks for help ;)

Wang
> brant williams
> FCAA CDCA 20BC 3925 D634  F5C4 7420 6784 4DEB 6002
>
> On Thu, 3 Jan 2008, Wang, Baojun wrote:
> > Date: Thu, 3 Jan 2008 00:11:10 +0800
> > From: "Wang, Baojun" <wangbj@×××××××.cn>
> > Reply-To: gentoo-hardened@l.g.o
> > To: gentoo-hardened@l.g.o
> > Cc: pageexec@××××××××.hu
> > Subject: Re: [gentoo-hardened] Fwd: hardened gentoo
> > mailman/postfix/apache notes?
> >
> > On Wednesday 02 January 2008 21:41:13, pageexec@××××××××.hu wrote：
> >
> >> On 2 Jan 2008 at 22:09, Wang, Baojun wrote:
> >>> Jan  2 12:20:07 mail [687055.942454] grsec: From 202.201.14.141: denied
> >>> untrusted exec of /usr/local/mailman/mail/mailman by /usr/lib/postfix/
> >>> local[local:17733] uid/euid:280/280 gid/egid:280/280,
> >>> parent /usr/lib/postfix/local[local:17732] uid/euid:0/207
> >>> gid/egid:0/207
> >>
> >> 'untrusted exec' is a sign of your using TPE, i suggest you check
> >> the kernel help on it and make sure the access rights on the path
> >> leading up to the executables are proper (in particular, only root
> >> should be able to write to the executables).
> >
> > OK, I've check TPE, since I'm using Grsecurity level hardened gentoo, TPE
> > is enabled by default, and I've configured the gid to trusted users to 10
> > (wheel), but mailman is 280, I'd like to leave it as it is, but I have to
> > add 280 to tpe_gid, I've tried
> >
> > echo "10 280" > /proc/sys/kernel/grsecurity
> >
> > but after that only 280 is in the (proc) file, is there any way to add
> > more than 1 group to tpe_gid? Also, even I echo 280
> > to /proc/sys/kernel/grsecurity, it still doesn't solve the problem, now
> > the problem is solved by echo 0 > /proc/sys/kernel/grsecurity/tpe, but I
> > wonder there is a better solution instead.
> >
> >>> or should I chown -R root:root /usr/local/mainman and chown a-S
> >>> /usr/local/manman?
> >>
> >> something like that will be needed, yes, but i don't know what exact
> >> permissions mailman needs to properly function, so be careful.
> >
> > I have also tried this, but mailman said it expect the program is invoked
> > by group mailman ;-(, otherwise I need to configure mailman manually, I
> > don't like to to that.
> >
> > --
> > Wang, Baojun                                      
> >  Lanzhou University Distributed & Embedded System Lab            
> >  http://dslab.lzu.edu.cn School of Information Science and Engeneering
> >     wangbj_AT_lzu.edu.cn Tianshui South Road 222. Lanzhou 730000    
> >                 .P.R.China Tel:[phone]            
> >                    Fax:[phone]



-- 
Wang, Baojun                                        Lanzhou University
Distributed & Embedded System Lab              http://dslab.lzu.edu.cn
School of Information Science and Engeneering     wangbj_AT_lzu.edu.cn
Tianshui South Road 222. Lanzhou 730000                     .P.R.China
Tel:[phone]                                Fax:[phone]