[gentoo-hardened] bonding module auto-loading

[Tóth Attila]

After a week I think I've sorted out nearly all issues about openrc on my
systems.
Bonding was compiled into the kernel. Upon I tried to echo mode 4
(802.3ad) to set up the lacp, the system said there's no write access to
the mode file. So the bonding interface remained in round-robin mode. That
was disturbing.

grsec: denied auto-loading kernel module for a network device with
CAP_SYS_MODULE (deprecated).  Use CAP_NET_ADMIN and alias netdev-bonding
instead.

I suspect there was something wrong in the background.
If I take a look at on the error message, I don't know that actually which
process tries to autoload the module. I would check out my policy to
specify CAP_NET_ADMIN also for that binary. For the second part I would be
interested to where I should add netdev-bonding as an alias for openrc or
whatnot?

I've ended up compiling bonding as a module and the interface is in the
correct mode now after reboot. Loading the module now happens before
locking down the system.

Regards:
Dw.
-- 
dr Tóth Attila, Radiológus, 06-20-825-8057
Attila Toth MD, Radiologist, [phone]