- Code: Select all
#!/bin/bash
while /bin/sleep 3; do
/bin/echo abc
done
ACL:
- Code: Select all
subject /home/hue/bin/echoer hpdAo {
user_transition_allow hue
group_transition_allow hue
/ h
/bin h
/bin/bash x
/bin/echo x
/bin/sleep x
/dev h
/dev/tty rw
/dev/urandom r
/etc h
/etc/ld.so.cache r
/etc/mtab r
/home h
/home/hue
/home/hue/bin/echoer rx
/lib h
/lib/ld-2.3.6.so x
/lib/libc-2.3.6.so rx
/lib/libdl-2.3.6.so rx
/lib/libncurses.so.5.5 rx
/proc h
/proc/meminfo r
/usr h
/usr/lib/gconv/gconv-modules.cache r
/usr/lib/locale
/usr/lib/locale/en_US.utf8 r
/usr/share/locale r
-CAP_ALL
bind disabled
connect disabled
}
subject /home/hue/bin/echoer:/bin/sleep hpdAo {
user_transition_allow hue
group_transition_allow hue
/ h
/dev h
/dev/urandom r
/etc h
/etc/ld.so.cache r
/lib h
/lib/ld-2.3.6.so x
/lib/libc-2.3.6.so rx
/usr h
/usr/lib/gconv/gconv-modules.cache r
/usr/lib/locale
/usr/lib/locale/en_US.utf8 r
/usr/share/locale r
-CAP_ALL
bind disabled
connect disabled
}
subject /home/hue/bin/echoer:/bin/echo hpdAo {
user_transition_allow hue
group_transition_allow hue
/ h
/dev h
/dev/urandom r
/etc h
/etc/ld.so.cache r
/lib h
/lib/ld-2.3.6.so x
/lib/libc-2.3.6.so rx
/usr h
/usr/lib/gconv/gconv-modules.cache r
/usr/lib/locale
/usr/lib/locale/en_US.utf8 r
/usr/share/locale r
-CAP_ALL
bind disabled
connect disabled
}
If I run the script and then reload gradm in another console, everything's ok:
- Code: Select all
$ echoer
abc
abc
abc
abc
abc
^C
$ _
As expected. Now let's try prepending "/bin/bash:" to each subject (and commenting out '/home/hue/bin/echoer rx' from the echoer policy to avoid an error from gradm about duplicated objects, since there's a line like that in bash policy):
- Code: Select all
$ echoer
abc
abc
abc
/home/hue/bin/echoer: line 3: /bin/echo: No such file or directory
/home/hue/bin/echoer: line 2: /bin/sleep: No such file or directory
When I do 'gradm -R', the system forgets the nesting and starts placing processes in the default subject:
- Code: Select all
(hue:U:/bin/bash) exec of /home/hue/bin/echoer (echoer ) by /bin/bash[...]
(hue:U:/home/hue/bin/echoer) exec of /bin/sleep (/bin/sleep 3 ) by /home/hue/bin/echoer[...]
(hue:U:/home/hue/bin/echoer) exec of /bin/echo (/bin/echo abc ) by /home/hue/bin/echoer[...]
(hue:U:/home/hue/bin/echoer) exec of /bin/sleep (/bin/sleep 3 ) by /home/hue/bin/echoer[...]
(hue:U:/home/hue/bin/echoer) exec of /bin/echo (/bin/echo abc ) by /home/hue/bin/echoer[...]
(hue:U:/home/hue/bin/echoer) exec of /bin/sleep (/bin/sleep 3 ) by /home/hue/bin/echoer[...]
(hue:U:/home/hue/bin/echoer) exec of /bin/echo (/bin/echo abc ) by /home/hue/bin/echoer[...]
(hue:U:/home/hue/bin/echoer) exec of /bin/sleep (/bin/sleep 3 ) by /home/hue/bin/echoer[...]
(admin:S:/) exec of /sbin/gradm (gradm -R ) by /bin/bash[...]
(root:U:/sbin/gradm) grsecurity 2.1.8 RBAC system reloaded by /sbin/gradm[...]
(hue:U:/) denied access to hidden file /bin/echo by /home/hue/bin/echoer[...]
<repeated 2 more times>
(hue:U:/) denied access to hidden file /usr/share/locale by /home/hue/bin/echoer[...]
<repeated 5 more times>
(hue:U:/) denied access to hidden file /bin/sleep by /home/hue/bin/echoer[...]
more alerts, logging disabled for 1 seconds
I expect the same results as in the first case. Am I doing something wrong?