One more..

Submit your RBAC policies or suggest policy improvements

One more..

Postby superbock » Wed May 14, 2003 11:28 am

Hello again :)

Objective: configure ACL's to prevent user with shell access to execute files in cgi-bin but allow them to be executed by suexec

User has a role. Inside the role, his home_dir is rw in the default subject.
Then, there is subject /usr/sbin/suexec, like this:

subject /usr/sbin/suexec {
/home/user/cgi-bin rx
/var/log/httpd/suexec_log a
}

All this is in a file that is included by "acl"

Then i reload the ACL's, and i get this:

Duplicate ACL entry found for "/usr/sbin/psa-suexec" on line 1 of /etc/grsec/acl.
"/usr/sbin/psa-suexec" references the same object as the following object(s):
/usr/sbin/suexec
specified on an earlier line.The ACL system will not load until this error is fixed.

suexec is a hardlink of psa-suexec. But i don't define any subject for any of them in the default acl. Also, the ACL's in roles aren't completely independent from the default ACL/role ?

Need some light here. Thanks again in advance.
superbock
 
Posts: 37
Joined: Sun Mar 31, 2002 6:34 pm

Postby spender » Wed May 14, 2003 6:06 pm

Can you mail your ACLs to spender@grsecurity.net? It would help to see them in context.

-Brad
spender
 
Posts: 2185
Joined: Wed Feb 20, 2002 8:00 pm

Postby superbock » Wed May 14, 2003 7:42 pm

Done!!

Tks!
superbock
 
Posts: 37
Joined: Sun Mar 31, 2002 6:34 pm

Postby spender » Fri May 16, 2003 6:04 pm

I haven't been able to duplicate the problem here. Could you grab current CVS of gradm2? I added some additional verbosity for that error that may help resolve the problem.

-Brad
spender
 
Posts: 2185
Joined: Wed Feb 20, 2002 8:00 pm

Postby superbock » Fri May 16, 2003 8:52 pm

Here it is:

Duplicate object found for "/usr/sbin/psa-suexec" in role some_user, subject /usr/sbin/suexec, on line 1 of /etc/grsec/acl.
"/usr/sbin/psa-suexec" references the same object as the following object(s):
/usr/sbin/suexec
specified on an earlier line.The RBAC system will not load until this error is fixed.

I'm pretty much in the dark as before. And I really don't understand why it complains about "line 1".
superbock
 
Posts: 37
Joined: Sun Mar 31, 2002 6:34 pm

Postby spender » Sat May 17, 2003 3:56 pm

Ok, I believe the problem is related to configuration inheritance. To verify, change all occurences of GR_FEXIST in gradm_opt.c to GR_FLEARN.

-Brad
spender
 
Posts: 2185
Joined: Wed Feb 20, 2002 8:00 pm

Postby superbock » Sun May 18, 2003 12:45 am

got latest CVS and did the change. gradm does not complain now and the acl seems to be working properly.
superbock
 
Posts: 37
Joined: Sun Mar 31, 2002 6:34 pm


Return to RBAC policy development