Gentoo Archives: gentoo-hardened

From: Sven Vermeulen <swift@g.o>
To: gentoo-hardened@l.g.o
Subject: Re: [gentoo-hardened] conky and /proc/net restrictions
Date: Sun, 30 Sep 2012 15:03:52
Message-Id: CAPzO=NxQm6orY5ge5UKtQ_SFPiFGazJnKUN1xiYF7qPJgPbs1A@mail.gmail.com
In Reply to: [gentoo-hardened] conky and /proc/net restrictions by Alex Efros
1 On Sep 30, 2012 3:25 PM, "Alex Efros" <powerman@××××××××.name> wrote:
2 > Is it possible to work around /proc/net restrictions to let conky access
3 > network traffic stats without running `sudo conky` or disabling
4 > CONFIG_GRKERNSEC_PROC_USER? Maybe using `setfacl` or something like that
5 > to mark /usr/bin/conky allowed to access /proc/net?
6
7 Iirc there is a kernel setting that defines which group (gid) is exempt
8 from this control. Perhaps you can use that and make the conky user part of
9 that group?
10
11 Wkr,
12 Sven Vermeulen