grsecurity forums

Hello,

I have setup a policy that I thought was decent enough to finally test out.. however, even after I authenticate to admin, I cannot disable RBAC. I run the command 'gradm -a admin' enter the password and it accpets it.

But from that, if I run 'gradm -S' it doesn't show anything... but worse is 'gradm -D' asks for the password, and never accepts it. When I run in full learning mode, it takes the password to disable it... but I see this in the learning log:

default 68 0 0 /bin/bash / 1 1 /sbin/gradm 16 192.168.0.100
default 68 0 0 /bin/bash / 1 1 /sbin/gradm 8 192.168.0.100

When I create a policy from the learning log, it doesn't do anything with /sbin/gradm.

So, it seems that my policy is missing something.. but I don't know what. Can anyone tell me what the above excerpt means?

I just post the beginning of one of my policies ...

role admin sA
subject / rvka
/ rwcdmlxi

role default
subject / {
/ h
-CAP_ALL
connect disabled
bind disabled
}

role root uG
role_transitions admin
...
...
...

Thanks for the reply.. I tried yours and it still shows up in the learning log.. here is the beginning of my policy:

role admin sA
subject / {
/ rwcdmlxi
+CAP_ALL
}

role default
subject / {
/ h
-CAP_ALL
connect disabled
bind disabled
}

role root uG
role_allow_ip 0.0.0.0/32
role_allow_ip 192.168.0.100/32
role_transitions admin

your admin role needs to have the "a" flag for the / subject., otherwise you can't use the admin role to disable the RBAC system (since the "a" flag is needed to use gradm).

-Brad

Thanks! That got me working now.

1 of 1 lurkers found this post helpful =)