grsecurity forums

I have this following ACL rule:

/usr/sbin/exim {
...
...
/dev/log rw
...
...
/usr/bin/spamc rxi
...
}

I also have a symlink from /usr/bin/sendmail -> /usr/sbin/exim.
BUT I get the following whine in my syslog anyways:

grsec: denied connect to the unix domain socket /dev/log by (spamc:8239) UID(42) EUID(42), parent (sendmail:21067) UID(42) EUID(42)

Now afaik this should not be possible... or am I mistaking?

it depends on how spamc is executed. Most likely what is happening is that exim is calling some shell which then calls spamc, so you'd need to add the inherit flag to that shell also.

-Brad