grsecurity forums

Hi,

I noticed a while ago that the learner seems to have problems with sockets. For instance, a while ago I set a machine into learning mode and logged in through ssh many times. However, once the policy was compiled an activated, the system refused to let me in straight away. The problem was that the learner decided to declare bind disabled for sshd when in fact bind 0.0.0.0/32:22 stream tcp was the right thing (or at least the problem disappeared), see my other post https://forums.grsecurity.net/viewtopic.php?f=5&t=3955#p13997

Now I am trying to figure out a policy for postfix which is composed of various services and daemons. I had the machine in learning mode for several weeks during which I received a lot of e-mail with bounces and everything, so pretty many execution paths were tried. Yet, after creating and activating a policy the system complained instantly with

Code: Select all

blah blah blah: grsec: (root:U:/usr/libexec/postfix/smtpd) denied socket(inet,stream,ip) by /usr/libexec/postfix/smtpd[smtpd:1198] uid/euid:0/0 gid/egid:0/0, parent /usr/libexec/postfix/master[master:1061] uid/euid:0/0 gid/egid:0/0

The policy for smtpd is (mostly generated from the learning logs and slightly adjusted)

Code: Select all

subject /usr/libexec/postfix/smtpd do {
user_transition_allow postfix
group_transition_allow postfix

        /                               h
        /dev                            h
        /dev/log                        rw
        /dev/urandom                    r
        /etc                            r
        /etc/grsec                      h
        /etc/gshadow                    h
        /etc/gshadow-                   h
        /etc/shadow                     h
        /etc/shadow-                    h
        /etc/ssh                        h
        /etc/stunnel                    h
        /lib                            rx
        /lib/modules                    h
        /proc                           h
        /proc/sys/kernel/ngroups_max    r
        /sys                            h
        /sys/devices/system/cpu/online  r
        /usr                            h
        /usr/lib                        rx
        /usr/libexec                    h
        /usr/libexec/postfix/smtpd      x
        /var                            h
        /var/spool/postfix              rw
        /var/tmp                       
        -CAP_ALL
        +CAP_DAC_READ_SEARCH
        +CAP_SETGID
        +CAP_SETUID
        bind    disabled
        connect disabled
        sock_allow_family unix inet ipv6 netlink
}


Interestingly, for user postfix the learner did the right thing (bind 0.0.0.0/32:25 stream dgram ip tcp). However, after adjusting the rule for root:U:/usr/libexec/postfix/smtpd I received the next complaint

Code: Select all

blah blah blah: grsec: (root:U:/usr/libexec/postfix/anvil) denied socket(inet,stream,ip) by /usr/libexec/postfix/anvil[anvil:1389] uid/euid:0/0 gid/egid:0/0, parent /usr/libexec/postfix/master[master:1061] uid/euid:0/0 gid/egid:0/0

and this time there was no "free ride" to solve the problem.

Is there any way to deal with this problem of socket permissions?