[rsbac] GET_STATUS_DATA - SCD/other = NOT_GRANTED

[Amon Ott]

On Mittwoch 25 Mai 2005 11:01, Rafal Bisingier wrote:
> I have many entries in log like:
> kern.info: rsbac_adf_request(): request GET_STATUS_DATA, pid 3218, 
ppid
> 1542, prog_name clamd, prog_file /usr/sbin/clamd, uid 43, audit_uid 
43,
> target_type SCD, tid other, attr none, value none, result 
NOT_GRANTED by
> JAIL

This is a sysctl read access, which is denied by JAIL. This behaviour 
has been changed in 1.2.5-pre.

> This one is about clamd and blocking module is JAIL, but I've seen 
also
> other programs (mostly daemons, but also login, ps, bash, tail) with 
the
> same target/request but blocked by RC or ACL

Before 1.2.4-bf2 read access to sysctl was completely unchecked. You 
can enable this access in RC and ACL where required.

1.2.5-pre adds a new SCD target sysctl for this purpose, but I did not 
want to add new targets in a 1.2.4 bugfix.

Amon.
-- 
http://www.rsbac.org - GnuPG: 2048g/5DEAAA30 2002-10-22
-------------- nächster Teil --------------
Ein Dateianhang mit Bin?rdaten wurde abgetrennt...
Dateiname   : nicht verf?gbar
Dateityp    : application/pgp-signature
Dateigr??e  : 189 bytes
Beschreibung: nicht verf?gbar
URL         : http://rsbac.dyndns.org/pipermail/rsbac/attachments/20050525/c50f4eae/attachment.bin