Unexpected behavior of 's' (suppress logs) object flag

[Kyoshiro]

It seems that when I add the 's' flag to any object, it gives full access.... For example, I set this subject :

Code: Select all

subject / {
        /               r
        /opt            rx
        /initrd         sh
        /root           sh
...
}


It gives full access to /root and /initrd the related role. I remove the 's' flags, and access is denied and logged.

Either I have misunderstood the suppress flag, or there's an issue in gradm/grsec here :p.

PS: I'm using latest grsec and gradm (v2.1.0) + kernel 2.4.28 + secfixes

[spender]

The suppress flag is broken in 2.1.0. I have fixed it in 2.1.1, a test release of which is available at http://grsecurity.net/~spender

-Brad

[Kyoshiro]

Thanks a lot, I'll wait for 2.1.1 to be released then