grsecurity forums

I see in the default policy that the admin role has full access to the system. The access control for / is rwcdxmil. The policy provided by gradm2 says sshd should be restarted in the admin role, thus denies access to sshd and its init script in the default role.

Given these two information, since there are inheritance in the role admin, I'd like to know if sshd will run in admin role or in default role when I restart it from the admin role. Maybe I need to logout to make sshd switch to default role ?

That's correct, anything run by the admin in the admin role gains the admin role until the admin does gradm -u or exits his shell.

-Brad

Okay that's great !