grsecurity forums

Hi, I recently upgraded grsecurity from 1.9.7d to 1.9.7f, and since then I've had problems rebooting my system. It seems none of the shutdown scripts are granted their permissions unless grsecurity is shut down or reloaded first.

Following are my rules for the scripts under /etc/rc.d:

Code: Select all

/etc/rc.d/init.d/rc kv {
   +CAP_DAC_OVERRIDE
   +CAP_KILL
   +CAP_MKNOD
   +CAP_NET_ADMIN
   +CAP_SYS_ADMIN
   +CAP_SYS_BOOT
   +CAP_SYS_PACCT
   +CAP_SYS_RAWIO
   +CAP_SYS_TIME
   +CAP_SYS_TTY_CONFIG

   /bin/dd ix
   /bin/kill ix
   /bin/stty ix
   /bin/umount x
   /dev/log w
   /dev/lvm rw
   /dev/rtc rw
   /etc/rc.d irx
   /etc/sysconfig irx
   /etc/adjtime rw
   /etc/random-seed rw
   /sbin/halt ix
   /sbin/hwclock ix
   /sbin/ifconfig ix
   /sbin/killall5 ix
   /sbin/route ix
   /sbin/swapoff ix
   /sbin/vgchange ix
}


Can you please paste some of the logs?

Also:

/bin/umount x

might be part of the problem (unless you have a /bin/umount ACL which grants it among other things CAP_SYS_ADMIN, which I would advise against)

-Brad

I had tried configuring my box so that it would reboot or shutdown with grsec running but had a massive amount of headaches getting the processes their proper access. It was a much easier solution to make sure I set /sbin/reboot and /sbin/halt hidden and whenever I want to reboot or shut down I'll just do a -a and then a -D.

This didnt seem much an issue since I wouldnt want the box rebooting unless I was in grsec admin mode anyways =)

Otherwise I would have had to give some processes rights I didnt want to in order for them to run properly (like umount).

Here is the log output:

Code: Select all

grsec: use of CAP_SYS_ADMIN denied for (klogd:2561) UID(0) EUID(0), parent (init:1) UID(0) EUID(0)
grsec: use of CAP_SYS_TTY_CONFIG denied for (rm:17578) UID(0) EUID(0), parent (K40sysklogd:18746) UID(0) EUID(0)
grsec: use of CAP_SYS_TTY_CONFIG denied for (rm:12883) UID(0) EUID(0), parent (K40sysklogd:18746) UID(0) EUID(0)
grsec: use of CAP_SYS_TTY_CONFIG denied for (K55setclock:15191) UID(0) EUID(0), parent (rc:19502) UID(0) EUID(0)
grsec: use of CAP_SYS_TTY_CONFIG denied for (stty:18676) UID(0) EUID(0), parent (K55setclock:17852) UID(0) EUID(0)
grsec: more denied capabilities, logging disabled for 30 seconds


Also, lvm won't shut down, hwclock fails (saying it can't read /dev/rtc), ifconfig can't shut down my interfaces etc.

I think I had the klogd error already in 1.9.7d (klogd have a separate acl granting it CAP_SYS_ADMIN).

/bin/umount x

might be part of the problem (unless you have a /bin/umount ACL which grants it among other things CAP_SYS_ADMIN, which I would advise against)

I do have an acl for /bin/umount (need access to cd-roms).

I had tried configuring my box so that it would reboot or shutdown with grsec running but had a massive amount of headaches getting the processes their proper access. It was a much easier solution to make sure I set /sbin/reboot and /sbin/halt hidden and whenever I want to reboot or shut down I'll just do a -a and then a -D.

I have considered this, but I want ctrl-alt-del to work, and since I have had it working before it seems odd it shouldn't work now (since my other acls are fine).

The only thing that may differ between my system and others is that I have a lvm (Linux Volume Manager) root partition and therefore boot my system with an initrd script. Though I don't see how that correlate to my problems, also since it works if I do gradm -R before I reboot.

I found my problem with klogd (spelling), and added some delays to the shutdown scripts to show more exact what's happening:

Code: Select all

grsec: use of CAP_SYS_TTY_CONFIG denied for (rm:14520) UID(0) EUID(0), parent (K40sysklogd:18700) UID(0) EUID(0)
grsec: use of CAP_SYS_TTY_CONFIG denied for (rm:4148) UID(0) EUID(0), parent (K40sysklogd:18700) UID(0) EUID(0)
grsec: admin (id 1) mode exited by (bash:13457) UID(0) EUID(0), parent (init:1) UID(0) EUID(0)
grsec: use of CAP_KILL denied for (killall5:28058) UID(0) EUID(0), parent (K50sendsignals:4403) UID(0) EUID(0)
grsec: use of CAP_KILL denied for (killall5:28058) UID(0) EUID(0), parent (K50sendsignals:4403) UID(0) EUID(0)
grsec: use of CAP_SYS_TTY_CONFIG denied for (K55setclock:12863) UID(0) EUID(0), parent (rc:9442) UID(0) EUID(0)
grsec: more denied capabilities, logging disabled for 30 seconds
grsec: use of CAP_SYS_TTY_CONFIG denied for (K60mountfs:2885) UID(0) EUID(0), parent (rc:9442) UID(0) EUID(0)
grsec: use of CAP_SYS_TTY_CONFIG denied for (stty:9588) UID(0) EUID(0), parent (K60mountfs:24090) UID(0) EUID(0)
grsec: use of CAP_SYS_TTY_CONFIG denied for (K65lvm:7330) UID(0) EUID(0), parent (rc:9442) UID(0) EUID(0)
grsec: use of CAP_SYS_TTY_CONFIG denied for (stty:26968) UID(0) EUID(0), parent (K65lvm:24563) UID(0) EUID(0)
grsec: denied open of /dev/lvm for reading by (vgchange:30356) UID(0) EUID(0), parent (K65lvm:7330) UID(0) EUID(0)
grsec: more denied file opens, logging disabled for 30 seconds
grsec: use of CAP_SYS_TTY_CONFIG denied for (K90localnet:7165) UID(0) EUID(0), parent (rc:9442) UID(0) EUID(0)
grsec: use of CAP_SYS_TTY_CONFIG denied for (stty:14925) UID(0) EUID(0), parent (K90localnet:215) UID(0) EUID(0)
grsec: use of CAP_DAC_OVERRIDE denied for (pidof:4392) UID(0) EUID(0), parent (K90localnet:7165) UID(0) EUID(0)
grsec: use of CAP_DAC_READ_SEARCH denied for (pidof:4392) UID(0) EUID(0), parent (K90localnet:7165) UID(0) EUID(0)
grsec: use of CAP_NET_ADMIN denied for (ifconfig:11348) UID(0) EUID(0), parent (K90localnet:7165) UID(0) EUID(0)
grsec: more denied capabilities, logging disabled for 30 seconds
grsec: use of CAP_SYS_TTY_CONFIG denied for (K99halt:17395) UID(0) EUID(0), parent (rc:9442) UID(0) EUID(0)
grsec: use of CAP_SYS_TTY_CONFIG denied for (stty:5925) UID(0) EUID(0), parent (K99halt:13932) UID(0) EUID(0)
grsec: use of CAP_NET_ADMIN denied for (halt:13435) UID(0) EUID(0), parent (K99halt:17395) UID(0) EUID(0)
grsec: use of CAP_SYS_BOOT denied for (halt:13435) UID(0) EUID(0), parent (K99halt:17395) UID(0) EUID(0)
grsec: use of CAP_SYS_BOOT denied for (halt:13435) UID(0) EUID(0), parent (K99halt:17395) UID(0) EUID(0)
grsec: more denied capabilities, logging disabled for 30 seconds


All K* scripts are located in /etc/rc.d/init.d with symlinks from /etc/rc.d/rc.?/*

I did some more tests and found that the problems are not fixed by reloading the acl, rather that there don't exist any grsecurity authenticated administrators active.