Want you to know i'm still a very happy grsec user!
But I ran into a new problem.We now have an EMC nas storage solution for storing user homedirs and files. The EMC has an function to make snapshots of the filesystem at certain times. We want users to have access to this snapshots through our grsec enabled shellserver. The users homedirs are located at /home/users/username and the snapshots at /home/users/.ckpt/timestamp/username. Because of the strict policy I have to explicitly grant read rights to a snapshot dir in my policy. And there is were thing go wrong.
When I have a policy like this
- Code: Select all
/home/users/username rwxcdl
/home/users/.ckpt/timestamp/username rx
I get the following error
- Code: Select all
Duplicate object found for "/home/users/.ckpt/2008_06_08_03.00.03_CEST/username" in role username.nl, subject /, on line 5 of /etc/grsec/policy.d/global_users.
"/home/users/.ckpt/2008_06_08_03.00.03_CEST/username" references the same object as the following object(s):
/home/users/username (due to symlinking/hardlinking)
specified on an earlier line.The RBAC system will not load until this error is fixed.
It seems to gradm that the snapshot and the actual homedir are the same objects. This i sort of true (because it is a snapshot) but they aren't in any way linked to eachother. At this moment there isn't a way for me to grant users read access to there snapshots.
Is this caused by the way gradm checks objects? Do you know about an possible solution?
Thanks in advance.
