I do not understands GrSecurity's RBAC-System with gradm

GOS

Hey guys,

recently I switched to hardened profile and activated GrSecurity's kernel features including Pax. Except some small problems related to python 2.7 my Xfce-desktop works well after exchanging icedtea-java by oracle java. :lol:

However, the only remaining feature I did not activated until now is GrSec's RBAC with gradm. This is because I do not really understand how it works (I looked e. g. at GrSec's Wiki-book, Gentoo wiki, Arch wiki and https://forums.gentoo.org/viewtopic-t-813544-highlight-gradm+rbac.html). Some questions for me are

1) Why there are different "roles" for gradm (admin, shutdown, masterpassword). Are the mentioned ones all or are there more "password secured roles" for gradm?
2) Why RBAC is activated with "gradm -E" and disbaled with "gradm -D" and not via a daemon? Is there a standard way to start ist during boot and diable it during shutdown?
3) Does RBAC restict also root? If yes, is there a possibility to get "unrestricted root access"? Is this question related to the "admin role" of gradm?

Hopefully my questions are not to stupid.

Cheers! GOS

PS: Is it (as last resort) possible to exchange GrSec's RBAC by AppArmor or something similar or do one lost here some functionality?

miroR · l33t Joined: 05 Mar 2008 Posts: 826

GOS · Posted: Mon Oct 12, 2015 12:53 pm Post subject:

Thanks for your answer. I downloaded the GrSec-Wiki documentation as pdf and relaized that there is some more stuff to read. I think I god it now.

About java:

Until now I used icedtea-bin for java 1.7, but this leads to failures related to PaX. For example Libreoffice-base cannot connect to the java engine, because pax prevents this. With oracles jdk this is different, because oracles pax flags are set correctly by default.

Because only Oracle provides java 1.8 one oracle engine is already installed and so I decided to exchange the icedtea-7 engine in favor of oracles 1.7 engine and now everything works.

Thanks again.

miroR · l33t Joined: 05 Mar 2008 Posts: 826

miroR · l33t Joined: 05 Mar 2008 Posts: 826

miroR · l33t Joined: 05 Mar 2008 Posts: 826

BTW, GOS, you don't have to mark this topic as [SOLVED]. The gradm is by far the hardest thing, if not the only hard thing to do, for newbies, with grsecurity. There will be other newbies coming to read here.

And, important thing for newbies to know:

grsecurity foxes most of the holes in the kernel anyway (some of them something like deliberately set in, such as hooks in the kernel you can read about in my signature), via its patching the kernel.

That means even if you don't deploy gradm numerous holes in the kernel wll anyway be closed....

Just not all... The remaining ones are closed with gradm.

So: it's worth installing grsecurity even without deploying gradm, and slowly learn to deploy it. It took me quite a few weekends to learn to deploy it and learn to use it, sparsed over quite a number of months.

( And in the meantime, I had got a huge following, because grsecurity is very much in demand by the thinking newbies, in my tip on Debian Forums:

Grsecurity/Pax installation on Debian GNU/Linux
http://forums.debian.net/viewtopic.php?f=16&t=108616
)

Regards!

GOS · Posted: Mon Oct 19, 2015 11:14 am Post subject:

Thanks a lot.

I will try to get rid of Oracle's Java.

Additionally I tackle the RBAC/gradm thing in near future, but at the moment I test if the rest of my system works good with the rest of GrSec's features, until there are no remaining problems.

At the moment the only thing I have issues with is VirtualBox

Best regards
GOS

PS: If someone is using Maxima / wxMaxima: At the moment it does not work with the stable sbcl (1.1.18). But with the testing version (1.2.16) everything is fixed ;-)

krinn · Watchman Joined: 02 May 2003 Posts: 7470

miroR · l33t Joined: 05 Mar 2008 Posts: 826

miroR · l33t Joined: 05 Mar 2008 Posts: 826

I just linked to this topic from:

Tips on Grsecurity installation for Gentoo newbies
http://forums.grsecurity.net/viewtopic.php?f=3&t=3974&p=15699#p15699

The tone of that post is to this tune:

miroR · l33t Joined: 05 Mar 2008 Posts: 826

Important, in my view, for newbies to know, is some of the information that can be find here.

NSA SELinux Support???
https://forums.gentoo.org/viewtopic-t-984066.html

Also important, but sad, and I hope, just a passing crippling state, that could affect some users of grsecurity, and I am telling you, kind readers who are seeking information like GOS, because I always do my best to not hide important information...

Also important is to know the current trouble the grsecurity is passing (I hope it will go for the better):

grsecurity withdrew support for stable; who did it to them?
https://forums.gentoo.org/viewtopic-t-1031476.html

The thing about FOSS Linux is, if grsecurity should fail in some way to be available for FOSS Linux users, the security in FOSS Linux for non-expert users would be very very hard to achieve. I am talking about true security, defence from surveillance, true privacy, true freedom of movement on the internet.

Regards!

GOS · Posted: Fri Nov 06, 2015 12:19 pm Post subject:

I would thank you again!!! There were a bunch of useful informations for me.

At the moment I am on the way to are hardened system. I think it is not the easiest thing, but it is worth the effort.

Additionally I noticed this Quickstart Guide in the forum "https://forums.gentoo.org/viewtopic-t-813544-highlight-rbac+quickstarting.html". Therefore one further question: Adding gradm -E to startup seems to be easy, but whats about shutdown. Should one take care about with something like executing gradm -D at shutdown. What is in this case with the gradm -D password?

Regards
GOS

miroR · l33t Joined: 05 Mar 2008 Posts: 826