Gentoo Hardened
When I enable the rbac system with no specific /bin/ls subject, and I login as root and type "ls", I get:
- Code: Select all
PAX: suspicious general protection fault: 0000 [#5]
CPU: 0
EIP: 0060:[<00127860>] Not tainted VLI
EFLAGS: 00010207 (2.6.21.1-grsec #2)
eax: 00000000 ebx: 00000000 ecx: 00000006 edx: 0000000f
esi: 00000000 edi: c06aeb82 ebp: c06cc1f1 esp: c9cc5e0c
ds: 0068 es: 0068 fs: 00d8 gs: 0033 ss: 0068
Process ls (pid: 18935, ti=c9cc4000 task=c155c5c0 task.ti=c9cc4000)
Stack: 00000000 0003e765 001321f8 00000000 00000000 c0c06420 c0c06574 00000044
c0c06570 dfd1ce74 000280d2 00030002 c06aeb7b 00000001 00000000 c9cc0002
c1667000 c0c06158 0000000e 0000000b 0003e9f4 c13fa000 dd22ad84 c0c04b40
Call Trace:
=======================
Code: c6 c0 89 d8 89 5c 24 34 8b 5c 24 44 83 c8 04 85 c9 0f 44 44 24 34 89 74 24 40 81 fb 40 4b c0 c0 89 44 24 34 74 2c 31 f6 8d 76 00 <8b> 7b 04 b9 ff ff ff ff 89 f0 89 7c 24 30 f2 ae f7 d1 49 66 ff
EIP: [<00127860>] SS:ESP 0068:c9cc5e0c
I don't know if this is a bug, feature, something sinister or what. Various other commands work, or get killed and logged by grsec correctly.
/etc/grsec/policy :
- Code: Select all
role admin sA
subject / rvka
/ rwcdmlxi
role default
subject / {
/ h
-CAP_ALL
connect disabled
bind disabled
}
role root uG
role_transitions admin
role_allow_ip 0.0.0.0/32
role_allow_ip 192.168.0.0/24
subject / {
/ r
/bin xi
/etc rx
/etc/grsec h
/etc/shadow h
/etc/passwd h
/lib rxi
/proc h
/proc/meminfo r
/sbin h
/sbin/gradm x
/usr h
/usr/bin/find x
/usr/sbin/run-crons rx
/var h
/var/spool/cron/lastrun
/var/spool/mail
/var/run r
/dev
/dev/null w
/dev/tty rw
/dev/urandom r
/dev/grsec h
/dev/mem h
/dev/kmem h
/dev/port h
/dev/log h
-CAP_ALL
bind disabled
connect disabled
}
subject /usr/sbin/sshd opd {
user_transition_allow root
group_transition_allow root
/
/bin/bash x
/dev h
/dev/log rw
/dev/null rw
/dev/ptmx rw
/dev/pts rw
/dev/urandom r
/dev/random r
/dev/tty rw
/etc h
/etc/group r
/etc/passwd r
/etc/shadow r
/etc/ld.so.cache r
/etc/ssh r
/etc/nsswitch.conf r
/etc/host.conf r
/etc/hosts r
/etc/resolv.conf r
/etc/protocols r
/etc/pam.d r
/etc/security/pam_env.conf r
/etc/security/limits.conf r
/root r
/root/.bash_history w
/lib rx
/usr h
/usr/lib
/usr/lib/libcrypto.so.0.9.8 rx
/usr/lib/libssl.so.0.9.8 rx
/usr/sbin/sshd rx
/usr/share/zoneinfo/GB r
/var h
/var/empty rw
/var/log
/var/log/lastlog rw
/var/log/wtmp w
/var/run
/var/run/utmp rw
/proc r
/proc/kcore h
/proc/bus h
-CAP_ALL
+CAP_CHOWN
+CAP_DAC_OVERRIDE
+CAP_SETGID
+CAP_SETUID
+CAP_SYS_CHROOT
+CAP_SYS_RESOURCE
+CAP_SYS_TTY_CONFIG
}
subject /bin/bash {
/
/bin x
/lib rx
/proc h
/proc/meminfo r
/sbin h
/sbin/gradm x
/usr rx
/usr/sbin/run-crons x
/var h
/var/run r
/var/spool/mail
/dev
/dev/null w
/dev/tty rw
/dev/urandom r
/dev/grsec h
/dev/mem h
/dev/kmem h
/dev/port h
/dev/log h
/etc r
/etc/ssh h
/etc/shadow h
/root
/root/.bash_history rwa
/root/.bashrc r
/root/.profile r
-CAP_ALL
bind disabled
connect disabled
}
