grsecurity2 learning mode.

[stone]

Hi Guys!

I'm fiddling around with grsecurity (have been running LIDS/SELinux/RSBAC before). But I can't get the learning mode to work. This is what I have done.
First the default "acl"
The added this at the bottom of the file

Code: Select all

subject /bin/ping lo {
    / h
   -CAP_ALL
}


Then:

Code: Select all

# gradm -E
# ping ...
# ping ...
# ping ...
# gradm -D
# gradm -L -O /etc/grsec/acl


But it's not working.
I have tested the full learning mode and that works.
Am I missing somthing here?
[/code]

[sekko]

You did it wrog. You have to do:

#gradm -L /root/ping-learn.log -E
# ping ...
# ping ...
# ping ...
# gradm -D
# gradm -L -O /root/ping-acl

then you'll have the ping's ACL in /root/ping-acl. You can then check the new ACL and put them in /etc/grsec/acl

Claudio

[stone]

After doing gradm -L /root/ping-learn.log -E
The file /root/ping-learn.log is zero bytes.

[sekko]

I used:

subject /bin/ping lo {
/ h
-CAP_ALL
bind disabled
connect disabled
}

And it worked here...