-bash: /sbin/gradm: No such file or directory

[sh4d0w]

Hi for somereason evertime i start gradm it locks me out completely
can anyone tell why this is happening here is my acl it' s stipped down to almost nothing.

/ {
/ hrwx
/dev hrx
/opt hrx
/home hrwx
/mnt hrx
/dev/urandom hr
/dev/random hr
/dev/zero hrw
/dev/input hrw
/dev/psaux hrx
/dev/tty? hrw
/dev/console hrw
/dev/tty hrw
/dev/ttyp? hrw
/dev/pts hrw
/dev/ptmx hrw
/dev/dsp hrw
/dev/mixer hrw
/dev/fd0 hr
/dev/cdrom hr
/dev/mem h
/dev/kmem h
/dev/port h
/bin hrx
/sbin hrx
/lib hrx
/usr hrx
/etc hrx
/etc/ssh hrx
/proc hrx
/proc/kcore h
/proc/sys hr
/root hr
/tmp hrw
/var hrx
/var/tmp rw
/var/log hr
/boot h
/etc/grsec hrx
/usr/sbin hrx
/usr/local hrx
/usr/local/sbin hrx
/usr/local/bin hrx
/etc/passwd hrx
/var/run hrx
/var/lib hrx
/etc/shadow hrx
/dev/log hrx
/sbin/shutdown hr
/sbin/reboot hr
/usr/bin hr
/usr/bin/reboot hr
/usr/sbin/sshd hr
/usr/bin/ssh hr
/root/gradm hrx
/usr/bin/skill h
/usr/bin/pkill h

-CAP_SYS_TTY_CONFIG
-CAP_LINUX_IMMUTABLE
-CAP_NET_RAW
-CAP_MKNOD
-CAP_SYS_ADMIN
-CAP_SYS_RAWIO
-CAP_SYS_MODULE
-CAP_SYS_PTRACE
-CAP_NET_ADMIN
-CAP_NET_BIND_SERVICE
-CAP_SYS_CHROOT
Thank you

[spender]

You have "h" on every object, even if you want to allow reading and executing. Have you read the documentation?

-Brad

[sh4d0w]

Yes i've read the doc's diligently it's a little confusing for me i apologize i did not know that h makes'it un readable/executable. I thought it only hid it in the process list. Thanx alot

[sh4d0w]

How come then when i have...

/usr/bin/kill h
/bin/kill h
/bin/cat h
/bin/vi h
and when i run gradm -E i can still kill processes with kill
ei: kill -9 2334 although killall cat and vi do not work.

[PaX Team]

and when i run gradm -E i can still kill processes with kill
ei: kill -9 2334 although killall cat and vi do not work.

i don't know about other shells but bash has builtin commands, such as kill (see the manpage). try to execute \kill with your ACLs and see it fail.

[spender]

regardless, the correct solution to prevent certain processes from being killed is to add to the subject mode of that process the "p" flag. otherwise someone can bypass your /usr/bin/kill h rules and write their own app that does the same thing.

-Brad