Re: [gentoo-hardened] Re: Do I need RBAC?

[Brant Williams]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


I'd recommend that you familiarize yourself with the documentation before 
trying out the learning mode.  It's not in the best state right now, but 
there is enough there to get an idea where to start.  Learning mode uses a 
learning configuration file.  Based on this file, grsec will build rules 
based on the activity it sees when in learning mode (e.g. if your 
unprivilaged user runs "passwd", grsec will see all the files that are 
executed/read/appended to/etc and then add it to the role for that user).  
Tweaking the policy can take some time; a good approach would be to watch 
/var/log/grsec.log when activating the RBAC system.  This way, you can 
determine what is too locked down (e.g. access to /etc/localtime) and 
correct it.

IMHO, it's great to use.  Unfortunately, I don't have a policy handy, but 
you can find a decent example one at:

http://forums.grsecurity.net/viewtopic.php?p=5555&

Documentation can be found at:

http://hardened.gentoo.org
http://www.grsecurity.net/papers.php

Hope that helps;  sorry I don't have an actual policy to show ATM...

- -Brant

Public GPG/PGP key for Brant Williams: 0x88E1AA9E.
Available at your friendly local public keyserver.



On Sun, 29 Oct 2006, Brian Davis wrote:

> So maybe I'm missing something.  Is learning mode all you need to do to get up
> and running?  How much time did you spend tweaking the profile? Is it a
> security no-no to ask to see your profile.
>
> Thanks,
> Brian
>
> ----- Original Message ----- From: <atoth@××××××××××.hu>
> To: <gentoo-hardened@l.g.o>
> Sent: Sunday, October 29, 2006 11:37 AM
> Subject: Re: [gentoo-hardened] Re: Do I need RBAC?
>
>
> > On Vas, Október 29, 2006 16:19, 7v5w7go9ub0o wrote:
> > > If you are talking about Grsecurity (which has a learning mode that makes
> > > configuration very easy), and if your users are doing limited, standard
> > > things, then a strong Yes!   (though IIUC, SeLinux is difficult to
> > > configure)
> > Strongly agree.
> >
> > I use Grsecurity even on my laptop, which has only one non-root user: me.
> > You can call me paranoid, but it's good to know, that my computer is
> > protected from myself...
> >
> > Regards,
> > Dw.
> >
> > --
> > dr Tóth Attila, Radiológus Szakorvos jelölt, 06-20-825-8057, 06-30-5962-962
> > Attila Toth MD, Radiologist in Training, [phone], [phone]
> >
> > >
> > > The RBAC protection will protect you if -you- or a trusted user does
> > > something accidentally (e.g. shell command), or downloads something that
> > > tries to exploit a news client or browser. It may also protect you if
> > > someone ever compromises a portage distribution.
> > >
> > > There seems to be a reluctance among some old-timers to use the hardened
> > > tools anywhere else but on a server - I'd guess that is a holdover from
> > > the last decade when both Linux and the hardening tools were being
> > > created. Today's (non-selinux) tools are easy to use, and are IMHO quite
> > > appropriate for home use in today's world of professional crackers going
> > > after home users. Heh, even MS is "hardening" their new OS, VISTA.
> > >
> > >
> > > On Sun, 29 Oct 2006 00:16:59 -0400,
> > > <bridavis-Wuw85uim5zDR7s880joybQ@××××××××××××.org> wrote:
> > >
> > > > I have a total of 3 non-root users, 1 is me, the 2 others are trusted
> > > > (i.e. family/friend). RBAC looks like it's more complex that I need and
> > > > want to deal with, and I'm I'm wondering if I should bother with this
> > > > with so few users.
> > > >
> > > > Thoughts?
> > > >
> > > > Thanks,
> > > > Brian
> > >
> > >
> > > --
> > > gentoo-hardened@g.o mailing list
> > >
> >
> >
> > --
> > gentoo-hardened@g.o mailing list
> >
>
> --
> gentoo-hardened@g.o mailing list
>
>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)

iD8DBQFFRZgHYfOV94jhqp4RAqDIAJ9P2wYWJuv5ne6uHXd5vlcaSGFeaACfVrBC
rUKcC8pCHivqrpnXkVUU0wc=
=vchO
-----END PGP SIGNATURE-----