| 1 |
What should that stuff be so gradm works. I tried add |
| 2 |
|
| 3 |
Also the wiki instructs me to issue gradm -E before putting it in learning mode. |
| 4 |
|
| 5 |
I've tried adding some lines to the admin role myself but the same |
| 6 |
problem occurs, and gradm can no longer find /dev/grsec.. |
| 7 |
|
| 8 |
role admin sA |
| 9 |
subject / rvka |
| 10 |
/ rwcdmlxi |
| 11 |
subject /sbin/gradm |
| 12 |
/etc/grsec rwx |
| 13 |
/dev/grsec rw |
| 14 |
+CAP_DAC_OVERRIDE |
| 15 |
|
| 16 |
It would be good if you could just help me get started by giving |
| 17 |
enough so that gradm -D will work so I can still work on the system |
| 18 |
without a reboot. At this point it is tedious. |
| 19 |
|
| 20 |
Also either the Wiki page is out of date and the advise no longer |
| 21 |
works, or the problem is actually some kernel option I've enabled: |
| 22 |
https://wiki.gentoo.org/wiki/Hardened/Grsecurity2_Quickstart |
| 23 |
|
| 24 |
|
| 25 |
On Tue, Feb 18, 2014 at 7:03 AM, "Tóth Attila" <atoth@××××××××××.hu> wrote: |
| 26 |
> I think you should not issue gradm -E before activating learning mode. |
| 27 |
> Also make sure to populate your policy with at least some default stuff |
| 28 |
> for the admin role before enabling it. The example policy file gives a |
| 29 |
> starting point. |
| 30 |
> -- |
| 31 |
> dr Tóth Attila, Radiológus, 06-20-825-8057 |
| 32 |
> Attila Toth MD, Radiologist, +36-20-825-8057 |
| 33 |
> |
| 34 |
> 2014.Február 17.(H) 20:29 időpontban John Tate ezt írta: |
| 35 |
>> I am new to grsecurity I am having a problem when I enable RBAC, where |
| 36 |
>> grsecurity denies gradm and certain directories such as /etc/grsec are |
| 37 |
>> inaccessible, and even /dev/grsec. |
| 38 |
>> |
| 39 |
>> gentoo ~ # gradm -E |
| 40 |
>> gentoo ~ # gradm -F -L /etc/grsec/learning.log |
| 41 |
>> Could not open /dev/grsec. |
| 42 |
>> open: Permission denied |
| 43 |
>> |
| 44 |
>> /var/log/messages contains this... |
| 45 |
>> Feb 16 22:40:56 gentoo kernel: [ 659.863486] grsec: From 192.168.0.3: |
| 46 |
>> (default:D:/sbin/gradm) use of CAP_DAC_OVERRIDE denied for |
| 47 |
>> /sbin/gradm[gradm:3315] uid/euid:0/0 gid/egid:0/0, parent |
| 48 |
>> /bin/bash[bash:1876] uid/euid:0/0 gid/egid:0/0 |
| 49 |
>> |
| 50 |
>> CONFIG_GRKERNSEC=y |
| 51 |
>> # CONFIG_GRKERNSEC_CONFIG_AUTO is not set |
| 52 |
>> CONFIG_GRKERNSEC_CONFIG_CUSTOM=y |
| 53 |
>> CONFIG_GRKERNSEC_TPE_UNTRUSTED_GID=101 |
| 54 |
>> CONFIG_GRKERNSEC_KMEM=y |
| 55 |
>> CONFIG_GRKERNSEC_IO=y |
| 56 |
>> CONFIG_GRKERNSEC_PERF_HARDEN=y |
| 57 |
>> CONFIG_GRKERNSEC_RAND_THREADSTACK=y |
| 58 |
>> CONFIG_GRKERNSEC_PROC_MEMMAP=y |
| 59 |
>> CONFIG_GRKERNSEC_BRUTE=y |
| 60 |
>> CONFIG_GRKERNSEC_MODHARDEN=y |
| 61 |
>> CONFIG_GRKERNSEC_HIDESYM=y |
| 62 |
>> CONFIG_GRKERNSEC_KERN_LOCKOUT=y |
| 63 |
>> # CONFIG_GRKERNSEC_NO_RBAC is not set |
| 64 |
>> CONFIG_GRKERNSEC_ACL_HIDEKERN=y |
| 65 |
>> CONFIG_GRKERNSEC_ACL_MAXTRIES=3 |
| 66 |
>> CONFIG_GRKERNSEC_ACL_TIMEOUT=60 |
| 67 |
>> CONFIG_GRKERNSEC_PROC=y |
| 68 |
>> CONFIG_GRKERNSEC_PROC_USER=y |
| 69 |
>> CONFIG_GRKERNSEC_PROC_ADD=y |
| 70 |
>> CONFIG_GRKERNSEC_LINK=y |
| 71 |
>> # CONFIG_GRKERNSEC_SYMLINKOWN is not set |
| 72 |
>> CONFIG_GRKERNSEC_FIFO=y |
| 73 |
>> CONFIG_GRKERNSEC_SYSFS_RESTRICT=y |
| 74 |
>> # CONFIG_GRKERNSEC_ROFS is not set |
| 75 |
>> CONFIG_GRKERNSEC_DEVICE_SIDECHANNEL=y |
| 76 |
>> CONFIG_GRKERNSEC_CHROOT=y |
| 77 |
>> CONFIG_GRKERNSEC_CHROOT_MOUNT=y |
| 78 |
>> CONFIG_GRKERNSEC_CHROOT_DOUBLE=y |
| 79 |
>> CONFIG_GRKERNSEC_CHROOT_PIVOT=y |
| 80 |
>> CONFIG_GRKERNSEC_CHROOT_CHDIR=y |
| 81 |
>> CONFIG_GRKERNSEC_CHROOT_CHMOD=y |
| 82 |
>> CONFIG_GRKERNSEC_CHROOT_FCHDIR=y |
| 83 |
>> CONFIG_GRKERNSEC_CHROOT_MKNOD=y |
| 84 |
>> CONFIG_GRKERNSEC_CHROOT_SHMAT=y |
| 85 |
>> CONFIG_GRKERNSEC_CHROOT_UNIX=y |
| 86 |
>> CONFIG_GRKERNSEC_CHROOT_FINDTASK=y |
| 87 |
>> CONFIG_GRKERNSEC_CHROOT_NICE=y |
| 88 |
>> CONFIG_GRKERNSEC_CHROOT_SYSCTL=y |
| 89 |
>> CONFIG_GRKERNSEC_CHROOT_CAPS=y |
| 90 |
>> CONFIG_GRKERNSEC_AUDIT_GROUP=y |
| 91 |
>> CONFIG_GRKERNSEC_AUDIT_GID=100 |
| 92 |
>> CONFIG_GRKERNSEC_EXECLOG=y |
| 93 |
>> CONFIG_GRKERNSEC_RESLOG=y |
| 94 |
>> CONFIG_GRKERNSEC_CHROOT_EXECLOG=y |
| 95 |
>> CONFIG_GRKERNSEC_AUDIT_PTRACE=y |
| 96 |
>> CONFIG_GRKERNSEC_AUDIT_CHDIR=y |
| 97 |
>> CONFIG_GRKERNSEC_AUDIT_MOUNT=y |
| 98 |
>> CONFIG_GRKERNSEC_SIGNAL=y |
| 99 |
>> CONFIG_GRKERNSEC_FORKFAIL=y |
| 100 |
>> CONFIG_GRKERNSEC_TIME=y |
| 101 |
>> CONFIG_GRKERNSEC_PROC_IPADDR=y |
| 102 |
>> CONFIG_GRKERNSEC_RWXMAP_LOG=y |
| 103 |
>> CONFIG_GRKERNSEC_DMESG=y |
| 104 |
>> CONFIG_GRKERNSEC_HARDEN_PTRACE=y |
| 105 |
>> CONFIG_GRKERNSEC_PTRACE_READEXEC=y |
| 106 |
>> # CONFIG_GRKERNSEC_SETXID is not set |
| 107 |
>> CONFIG_GRKERNSEC_TPE=y |
| 108 |
>> CONFIG_GRKERNSEC_TPE_ALL=y |
| 109 |
>> # CONFIG_GRKERNSEC_TPE_INVERT is not set |
| 110 |
>> CONFIG_GRKERNSEC_TPE_GID=101 |
| 111 |
>> CONFIG_GRKERNSEC_RANDNET=y |
| 112 |
>> CONFIG_GRKERNSEC_BLACKHOLE=y |
| 113 |
>> CONFIG_GRKERNSEC_NO_SIMULT_CONNECT=y |
| 114 |
>> # CONFIG_GRKERNSEC_SOCKET is not set |
| 115 |
>> # CONFIG_GRKERNSEC_DENYUSB is not set |
| 116 |
>> CONFIG_GRKERNSEC_SYSCTL=y |
| 117 |
>> # CONFIG_GRKERNSEC_SYSCTL_DISTRO is not set |
| 118 |
>> CONFIG_GRKERNSEC_SYSCTL_ON=y |
| 119 |
>> # CONFIG_GRKERNSEC_SELINUX_AVC_LOG_IPADDR is not set |
| 120 |
>> CONFIG_GRKERNSEC_FLOODTIME=10 |
| 121 |
>> CONFIG_GRKERNSEC_FLOODBURST=6 |
| 122 |
>> |
| 123 |
>> Help would really be appreciated to get this working, because I'm |
| 124 |
>> quite new to this and I have no idea what I've missed. |
| 125 |
>> |
| 126 |
>> -- |
| 127 |
>> www.johntate.org |
| 128 |
>> |
| 129 |
> |
| 130 |
> |
| 131 |
> |
| 132 |
|
| 133 |
|
| 134 |
|
| 135 |
-- |
| 136 |
www.johntate.org |
Archives