1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
|
From: Kerin Millar <kerframil@gmail.com>
grsecurity contains a number of options which allow certain protections
to be applied to or exempted from members of a given group. However, the
default GIDs specified in the upstream patch are entirely arbitrary and
there is no telling which (if any) groups the GIDs will correlate with
on an end-user's system. Because some users don't pay a great deal of
attention to the finer points of kernel configuration, it is probably
wise to specify some reasonable defaults so as to stop careless users
from shooting themselves in the foot.
diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
--- a/grsecurity/Kconfig 2011-12-12 16:54:30.000000000 -0500
+++ b/grsecurity/Kconfig 2011-12-12 16:55:09.000000000 -0500
@@ -433,7 +433,7 @@
config GRKERNSEC_PROC_GID
int "GID for special group"
depends on GRKERNSEC_PROC_USERGROUP
- default 1001
+ default 10
config GRKERNSEC_PROC_ADD
bool "Additional restrictions"
@@ -657,7 +657,7 @@
config GRKERNSEC_AUDIT_GID
int "GID for auditing"
depends on GRKERNSEC_AUDIT_GROUP
- default 1007
+ default 100
config GRKERNSEC_EXECLOG
bool "Exec logging"
@@ -848,7 +848,7 @@
config GRKERNSEC_TPE_GID
int "GID for untrusted users"
depends on GRKERNSEC_TPE && !GRKERNSEC_TPE_INVERT
- default 1005
+ default 100
help
Setting this GID determines what group TPE restrictions will be
*enabled* for. If the sysctl option is enabled, a sysctl option
@@ -857,7 +857,7 @@
config GRKERNSEC_TPE_GID
int "GID for trusted users"
depends on GRKERNSEC_TPE && GRKERNSEC_TPE_INVERT
- default 1005
+ default 10
help
Setting this GID determines what group TPE restrictions will be
*disabled* for. If the sysctl option is enabled, a sysctl option
@@ -930,7 +930,7 @@
config GRKERNSEC_SOCKET_ALL_GID
int "GID to deny all sockets for"
depends on GRKERNSEC_SOCKET_ALL
- default 1004
+ default 65534
help
Here you can choose the GID to disable socket access for. Remember to
add the users you want socket access disabled for to the GID
@@ -951,7 +951,7 @@
config GRKERNSEC_SOCKET_CLIENT_GID
int "GID to deny client sockets for"
depends on GRKERNSEC_SOCKET_CLIENT
- default 1003
+ default 65534
help
Here you can choose the GID to disable client socket access for.
Remember to add the users you want client socket access disabled for to
@@ -969,7 +969,7 @@
config GRKERNSEC_SOCKET_SERVER_GID
int "GID to deny server sockets for"
depends on GRKERNSEC_SOCKET_SERVER
- default 1002
+ default 65534
help
Here you can choose the GID to disable server socket access for.
Remember to add the users you want server socket access disabled for to
|
GitWeb