grsecurity forums

Hello,

in which runlevel should one place the script that enables the RBAC system on Gentoo, with maximum security in mind? And, should it run before or after the other scripts in that runlevel? I'd be grateful if you can give an explanation as well, to understand the reason behind it.

If you start it too early, you end up requiring policy for many more privileged accesses than are needed by various services at runtime. I instead recommend making sure the system is fully firewalled off until RBAC has started. You should also ensure that cron/atd and the like start after RBAC has started.

-Brad