For example, I try to contact a ldap server in admin role. In each case ldapsearch works correctly in default mode and pam_ldap too. Then it's not a ldap config issue.I have this policy for admin role :
- Code: Select all
role admin sA
subject / rk {
/ rwcdmxil
+CAP_ALL
RES_FILES unlimited unlimited
}
With these rules,in admin role :
- ldapsearch on a remote ldap server => unable to contact server. In fact I receive nothing on the ldap server and strace tells me that connect is in state -EINPROG, in progress. But the ldapsearch is doing a select on -1 fd, => -EINVAL. No grsecurity logs.
- telnet/nc remote ldap server make through it
When I add the learning mode to subject /, ldapsearch works fine and the learning log says someting like :
- Code: Select all
admin 72 0 0 /usr/bin/ldapsearch / u -1 0 0 xxx.xxx.xxx.xxx
admin 72 0 0 /usr/bin/ldapsearch / g -1 0 0 xxx.xxx.xxx.xxx
If I remove the learning mode and any RES_*, ldapsearch is ok in admin role.
.
