grsecurity forums

Hi,
is it possible to 1) query all special roles currently assigned in system 2) send GR_UNSPROLE as another process in order to remove this process from special role.

Is it ok to send GR_SPROLE to kernel from own program (not shell) (actually do be a real_parent of process which does it)?

--
best regards,
Kris

In /proc/pid/status you can see the name of the special role for a process. Only a process in a given special role can remove itself from that special role. It doesn't have to be from a shell, as the unauth command removes the special role from any process that has it.

-Brad