Problems when rebooting or shutting down the system.

Discuss usability issues, general maintenance, and general support issues for a grsecurity-enabled system.

Problems when rebooting or shutting down the system.

Postby goodbyte » Sat Apr 19, 2003 11:09 am

Hi, I recently upgraded grsecurity from 1.9.7d to 1.9.7f, and since then I've had problems rebooting my system. It seems none of the shutdown scripts are granted their permissions unless grsecurity is shut down or reloaded first.

Following are my rules for the scripts under /etc/rc.d:

Code: Select all
/etc/rc.d/init.d/rc kv {
   +CAP_DAC_OVERRIDE
   +CAP_KILL
   +CAP_MKNOD
   +CAP_NET_ADMIN
   +CAP_SYS_ADMIN
   +CAP_SYS_BOOT
   +CAP_SYS_PACCT
   +CAP_SYS_RAWIO
   +CAP_SYS_TIME
   +CAP_SYS_TTY_CONFIG

   /bin/dd ix
   /bin/kill ix
   /bin/stty ix
   /bin/umount x
   /dev/log w
   /dev/lvm rw
   /dev/rtc rw
   /etc/rc.d irx
   /etc/sysconfig irx
   /etc/adjtime rw
   /etc/random-seed rw
   /sbin/halt ix
   /sbin/hwclock ix
   /sbin/ifconfig ix
   /sbin/killall5 ix
   /sbin/route ix
   /sbin/swapoff ix
   /sbin/vgchange ix
}
goodbyte
 
Posts: 32
Joined: Sun May 12, 2002 4:33 am

Postby spender » Sat Apr 19, 2003 1:04 pm

Can you please paste some of the logs?

Also:

/bin/umount x

might be part of the problem (unless you have a /bin/umount ACL which grants it among other things CAP_SYS_ADMIN, which I would advise against)

-Brad
spender
 
Posts: 2185
Joined: Wed Feb 20, 2002 8:00 pm

Postby TGKx » Sat Apr 19, 2003 10:32 pm

I had tried configuring my box so that it would reboot or shutdown with grsec running but had a massive amount of headaches getting the processes their proper access. It was a much easier solution to make sure I set /sbin/reboot and /sbin/halt hidden and whenever I want to reboot or shut down I'll just do a -a and then a -D.

This didnt seem much an issue since I wouldnt want the box rebooting unless I was in grsec admin mode anyways =)

Otherwise I would have had to give some processes rights I didnt want to in order for them to run properly (like umount).
TGKx
 
Posts: 50
Joined: Wed Feb 19, 2003 4:39 am

Logs

Postby goodbyte » Sun Apr 20, 2003 9:07 am

Here is the log output:
Code: Select all
grsec: use of CAP_SYS_ADMIN denied for (klogd:2561) UID(0) EUID(0), parent (init:1) UID(0) EUID(0)
grsec: use of CAP_SYS_TTY_CONFIG denied for (rm:17578) UID(0) EUID(0), parent (K40sysklogd:18746) UID(0) EUID(0)
grsec: use of CAP_SYS_TTY_CONFIG denied for (rm:12883) UID(0) EUID(0), parent (K40sysklogd:18746) UID(0) EUID(0)
grsec: use of CAP_SYS_TTY_CONFIG denied for (K55setclock:15191) UID(0) EUID(0), parent (rc:19502) UID(0) EUID(0)
grsec: use of CAP_SYS_TTY_CONFIG denied for (stty:18676) UID(0) EUID(0), parent (K55setclock:17852) UID(0) EUID(0)
grsec: more denied capabilities, logging disabled for 30 seconds


Also, lvm won't shut down, hwclock fails (saying it can't read /dev/rtc), ifconfig can't shut down my interfaces etc.

I think I had the klogd error already in 1.9.7d (klogd have a separate acl granting it CAP_SYS_ADMIN).

/bin/umount x

might be part of the problem (unless you have a /bin/umount ACL which grants it among other things CAP_SYS_ADMIN, which I would advise against)

I do have an acl for /bin/umount (need access to cd-roms).

I had tried configuring my box so that it would reboot or shutdown with grsec running but had a massive amount of headaches getting the processes their proper access. It was a much easier solution to make sure I set /sbin/reboot and /sbin/halt hidden and whenever I want to reboot or shut down I'll just do a -a and then a -D.

I have considered this, but I want ctrl-alt-del to work, and since I have had it working before it seems odd it shouldn't work now (since my other acls are fine).

The only thing that may differ between my system and others is that I have a lvm (Linux Volume Manager) root partition and therefore boot my system with an initrd script. Though I don't see how that correlate to my problems, also since it works if I do gradm -R before I reboot.
goodbyte
 
Posts: 32
Joined: Sun May 12, 2002 4:33 am

More logs...

Postby goodbyte » Sun Apr 20, 2003 12:34 pm

I found my problem with klogd (spelling), and added some delays to the shutdown scripts to show more exact what's happening:

Code: Select all
grsec: use of CAP_SYS_TTY_CONFIG denied for (rm:14520) UID(0) EUID(0), parent (K40sysklogd:18700) UID(0) EUID(0)
grsec: use of CAP_SYS_TTY_CONFIG denied for (rm:4148) UID(0) EUID(0), parent (K40sysklogd:18700) UID(0) EUID(0)
grsec: admin (id 1) mode exited by (bash:13457) UID(0) EUID(0), parent (init:1) UID(0) EUID(0)
grsec: use of CAP_KILL denied for (killall5:28058) UID(0) EUID(0), parent (K50sendsignals:4403) UID(0) EUID(0)
grsec: use of CAP_KILL denied for (killall5:28058) UID(0) EUID(0), parent (K50sendsignals:4403) UID(0) EUID(0)
grsec: use of CAP_SYS_TTY_CONFIG denied for (K55setclock:12863) UID(0) EUID(0), parent (rc:9442) UID(0) EUID(0)
grsec: more denied capabilities, logging disabled for 30 seconds
grsec: use of CAP_SYS_TTY_CONFIG denied for (K60mountfs:2885) UID(0) EUID(0), parent (rc:9442) UID(0) EUID(0)
grsec: use of CAP_SYS_TTY_CONFIG denied for (stty:9588) UID(0) EUID(0), parent (K60mountfs:24090) UID(0) EUID(0)
grsec: use of CAP_SYS_TTY_CONFIG denied for (K65lvm:7330) UID(0) EUID(0), parent (rc:9442) UID(0) EUID(0)
grsec: use of CAP_SYS_TTY_CONFIG denied for (stty:26968) UID(0) EUID(0), parent (K65lvm:24563) UID(0) EUID(0)
grsec: denied open of /dev/lvm for reading by (vgchange:30356) UID(0) EUID(0), parent (K65lvm:7330) UID(0) EUID(0)
grsec: more denied file opens, logging disabled for 30 seconds
grsec: use of CAP_SYS_TTY_CONFIG denied for (K90localnet:7165) UID(0) EUID(0), parent (rc:9442) UID(0) EUID(0)
grsec: use of CAP_SYS_TTY_CONFIG denied for (stty:14925) UID(0) EUID(0), parent (K90localnet:215) UID(0) EUID(0)
grsec: use of CAP_DAC_OVERRIDE denied for (pidof:4392) UID(0) EUID(0), parent (K90localnet:7165) UID(0) EUID(0)
grsec: use of CAP_DAC_READ_SEARCH denied for (pidof:4392) UID(0) EUID(0), parent (K90localnet:7165) UID(0) EUID(0)
grsec: use of CAP_NET_ADMIN denied for (ifconfig:11348) UID(0) EUID(0), parent (K90localnet:7165) UID(0) EUID(0)
grsec: more denied capabilities, logging disabled for 30 seconds
grsec: use of CAP_SYS_TTY_CONFIG denied for (K99halt:17395) UID(0) EUID(0), parent (rc:9442) UID(0) EUID(0)
grsec: use of CAP_SYS_TTY_CONFIG denied for (stty:5925) UID(0) EUID(0), parent (K99halt:13932) UID(0) EUID(0)
grsec: use of CAP_NET_ADMIN denied for (halt:13435) UID(0) EUID(0), parent (K99halt:17395) UID(0) EUID(0)
grsec: use of CAP_SYS_BOOT denied for (halt:13435) UID(0) EUID(0), parent (K99halt:17395) UID(0) EUID(0)
grsec: use of CAP_SYS_BOOT denied for (halt:13435) UID(0) EUID(0), parent (K99halt:17395) UID(0) EUID(0)
grsec: more denied capabilities, logging disabled for 30 seconds


All K* scripts are located in /etc/rc.d/init.d with symlinks from /etc/rc.d/rc.?/*
goodbyte
 
Posts: 32
Joined: Sun May 12, 2002 4:33 am

Another update

Postby goodbyte » Sun Apr 20, 2003 12:47 pm

I did some more tests and found that the problems are not fixed by reloading the acl, rather that there don't exist any grsecurity authenticated administrators active.
goodbyte
 
Posts: 32
Joined: Sun May 12, 2002 4:33 am


Return to grsecurity support

cron