grsecurity forums

Hello,

I would like to create a "mini-root" role in which it can do all things but:
1) alter files under /var/log
2) unable to alter grsecurity

Is something like this possible?

If so could you point me in the right direction to create the role? Just looking for an example.

Thanks,

CM

It's not possible if you really mean "do all things." The problem is that even ignoring the problem of kernel exploits, unless you restrict this role considerably, it ends up being equivalent to full root, and thus able to alter grsecurity and edit /var/log. One simple example (though there are dozens or hundreds more): CAP_SYS_MODULE. With this capability, you have arbitrary code execution in the kernel, and so can disable/alter grsecurity, give yourself permission to alter any file, give yourself any of the other capabilities, etc.

So without considerable restriction (like the kinds of restrictions that the RBAC system enforces on non-special roles by default) such a role would almost entirely create a false sense of security.

-Brad