grsecurity forums

Hi,

I've been trying to see if there's any way at the moment to support nested subjects for learning. This is especially useful for the root policy and cron, to avoid granting policy-wide rights to the software run inside cron jobs. It seems like this feature isn't supported yet. Are there any plans to solve it? Or at least support a minimum depth of one or two levels for learning nested subjects? Do we have a workaround for this limitation not involving writing the policy from scratch, manually?

Do you need the full complexity of nested subjects? For instance, would it be possible for you to only allow cron to exec scripts in /etc/cron.*, and then set up inheritance rules for the /etc/cron.* scripts? The learning system can handle that kind of configuration.

-Brad