Here is how my /etc/grsec/acl looks like:
- Code: Select all
/ lo {
/lib r
/proc/sys r
/dev/mem h
/dev/kmem h
/etc/grsec x
/root rx
/boot rx
/etc rw
/bin rx
/home rxw
/usr rx
/sbin rx
/tmp rw
/ rw
+CAP_ALL
}
/usr/bin/passwd lo {
/usr/bin/passwd x
/ h
/home x
-CAP_ALL
}
/usr/local/apache/bin/httpd lo {
/usr/local/apache/bin/httpd x
/ h
/home x
/tmp rw
-CAP_ALL
connect {
disabled
}
bind {
disabled
}
}
/usr/sbin/sendmail lo {
/ h
/tmp rw
-CAP_ALL
RES_NPROC 15 20
connect {
disabled
}
bind {
disabled
}
}
/usr/sbin/exim lo {
/ h
/tmp rw
-CAP_ALL
RES_NPROC 15 20
connect {
disabled
}
bind {
disabled
}
}
/usr/bin/perl lo {
/ h
/home x
/tmp rw
-CAP_ALL
RES_NPROC 20 25
connect {
disabled
}
bind {
disabled
}
}
and after I run "gradm -L -O learn"
after 24 hours of running in learning mode the file "learn" didn't change at all. It is still the same from the first second of running in learn mode.
This server serves a lot of bandwidth and mirrors, there was 15GB bandwidth for these 24 hours, but no changes for /usr/local/apache/bin/httpd which was ran a lot..
Any suggestions what I'm doing wrong?
