root and user_transition_deny

[windo]

kernel 2.6.23-16+grsec

i tried to restrict root from using "su" to become any user, but was unable to do so. the following piece of policy does not allow root to use su at all:

subject /bin/su dp
user_transition_deny nobody
/dev/log rw

complains of missing CAP_SETUID, CAP_SETGID, however this allows root to so to anybody (including nobody):

subject /bin/su dp
user_transition_deny nobody
/dev/log rw
+CAP_SETUID
+CAP_SETGID

missing feature, bug, misconfiguration?

[spender]

This feature appears to have gone missing during the port to the 2.6.23 kernel. I've uploaded new patches to the website that restores the functionality. Cormander (a poster here on the forums) is working on RBAC regression tests that will ensure this kind of thing doesn't happen again. Thanks for reporting this issue!

-Brad