1 |
Hi, I think that /sbin/rc should be changed from a shell script, the |
2 |
reason is that with gentoo hardened, security policies could be done |
3 |
removing all linux capabilities to root (and CAP_DAC_OVERRIDE), in my |
4 |
setup syslog-ng is launched as user audit (which has CAP_SYS_ADMIN and |
5 |
CAP_DAC_OVERRIDE as minimun rsbac capabilities), and between others |
6 |
utmp has owner as audit user. Since root has not capabilities this |
7 |
file cannot be touched, and chmod at boot. I can't grant to /sbin/rc a |
8 |
minimum capability CAP_DAC_OVERRIDE because it doesn't work since it's |
9 |
a bash shell-script, and granting it to mv, chmod etc is not a good |
10 |
idea as you can suppose :). Could it be done? |