Permission elevation/issues through badly done acls

[ijuz]

Hello,
I just wanted to know if the grsecurity acl's superseed any normal unix permissions, I don't think so, but I'm not entirely sure.
(I just would like to limit some applications, I would like to have the rest working like before)

with kind regards
Christian Leber

[spender]

No, grsecurity does not override regular DAC permissions. There's several reasons for this: it removes the chance of the admin doing something stupid that would make his system worse off than it originally is, it removes the chance of their being a bug in such overriding code that would make the system worse off than it originally is, and also doing it the way grsecurity does it is according to DOD silver book specifications.

-Brad