grsecurity forums

Hello,

Im currently running grsec kernel 4.4.9 on Centos 7.2. I encounter the following odd things :

On the lateset 4.4.9 patch im having some interesting issues regarding the load on the server :

Without grsec the load is around 4-5 load average.

With grsec it starts at around 8-9 load average and after 30 minutes it gets to 26-27.

The second issue im having is a RBAC one. Im using the same policy from the 3.14 patch for RBAC but im seeing the following on the /var/log/messages even if the subject is created :

Code: Select all

May 10 10:43:01 web15 kernel: grsec: (default:D:/) denied access to hidden file /var/log/tomcat/localhost.log by /usr/lib/jvm/java-1.8.0-oracle-1.8.0.40.x86_64/jre/bin/java[<file:1585] uid/euid:982/982 gid/egid:978/978, parent /usr/lib/systemd/systemd[systemd:1] uid/euid:0/0 gid/egid:0/0


The java binary has a subject :

Code: Select all

subject /usr/lib/jvm/java-1.8.0-oracle-1.8.0.40.x86_64/jre/bin/java o {
   /            h
   /dev            h
   /dev/random         r
   /dev/urandom         r
   /etc            r
   /etc/grsec         h
   /etc/gshadow         h
   /etc/gshadow-         h
   /etc/ppp         h
   /etc/samba/smbpasswd      h
   /etc/shadow         h
   /etc/shadow-         h
   /etc/ssh         h
   /proc            r
   /proc/bus         h
   /proc/kallsyms         h
   /proc/kcore         h
   /proc/modules         h
   /proc/slabinfo         h
   /sys            h
   /sys/devices/system/cpu      
   /sys/devices/system/cpu/online   r
   /tmp            rwcd
   /usr            
   /usr/lib         rx
   /usr/lib64         rx
   /usr/share         rwc
   /usr/src         h
   /var            
   /var/backups         h
   /var/cache         rwcd
   /var/lib         rwc
   /var/log/tomcat         w
   -CAP_ALL
   +CAP_DAC_READ_SEARCH
   +CAP_NET_BIND_SERVICE
   bind 0.0.0.0/32:0 dgram ip
   connect 0.0.0.0/0:0 dgram udp
   connect 0.0.0.0/0:53 dgram udp
   sock_allow_family ipv6 netlink
}


Anyone has any ideas or encountered those things ?