grsecurity forums

Ok well im having but one issue with gradm, i manualy configured most of my ACL's but i think its all borken my email. In anycase i tryed enabling the learning mode with just

/ l {
}

Obviously that didnt work so i did

/ l {
/ rwx
}

Then i got errors that gradm wont start insecurly (basicly).

so anyways i grabed default acl's, set learning mode and fixed a few small things gradm complained about (mainly /lib).

Now -- i enabled learning mode and proceed to check my email but it still wont work with gradm in learning mode. It only works with ACL completleyl off (gradm -D). So im assuming some ACL restrictions are staying inplace while in learning mode. How could i get gradm to do more verbose learning as in watch everything and learn from EVERYTHING going on, on the system (from every process). I know it would be a tad intensive but this way il beable to pick around the ACL it generates and work out were my email is messing up.

I use a rather intrusive control panel system called Ensim so allot of things are not very visable to the naked eye at a glance.

Any comments would be of help.

Ok i found that the problem is, gradm wont allow writable libs to load. Lib in this case is /lib/security/pam_ensimvwh.so

My issue now is that the pam_ensimvwh.so file is located in each virtual site on 'Ensim' (chroot enviroment), under /home/virtual/site#/fst/lib/security/pam_ensimvwh.so

is it possible to define wild cards in acl rules ? so i could do something like

/ {
/home/virtual/site*/fst/lib/ rx
}

another question, whats a use for 'RES_CRASH'. It seems vaugly documented.

we don't support wildcards, though it's something we could do in the future. When it is supported, you'll have to remember that it won't work dynamically. eg. if you are using a wildcard that is supposed to represent 30 user directories, if you add another user directory while the ACL system is enabled, it won't include that new directory.

As for RES_CRASH, it's useful for if you're using PaX. It prevents daemons from being the target of exploit bruteforcing.

-Brad

ya i just made a script to generate some rules for all my virtual sites. it works pretty well i guess and i love the ACL as is so all is good .

as for the system-wide learning, it's going to be developed when we support nested ACLs.

-Brad