From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from lists.gentoo.org ([140.105.134.102] helo=robin.gentoo.org) by nuthatch.gentoo.org with esmtp (Exim 4.54) id 1F6Hhl-00005G-4W for garchives@archives.gentoo.org; Tue, 07 Feb 2006 01:31:41 +0000 Received: from robin.gentoo.org (localhost [127.0.0.1]) by robin.gentoo.org (8.13.5/8.13.5) with SMTP id k171S60m001877; Tue, 7 Feb 2006 01:28:06 GMT Received: from services.felinemenace.org (services.felinemenace.org [69.55.233.11]) by robin.gentoo.org (8.13.5/8.13.5) with ESMTP id k171S4Cl028378 for ; Tue, 7 Feb 2006 01:28:05 GMT Received: from pluto (220-245-151-251-vic-pppoe.tpgi.com.au [220.245.151.251]) by services.felinemenace.org (Postfix) with SMTP id 63CB630E1 for ; Tue, 7 Feb 2006 01:27:24 +0000 (Local time zone must be set--see zic manual page) Received: by pluto (sSMTP sendmail emulation); Tue, 7 Feb 2006 11:31:38 +0000 Date: Tue, 7 Feb 2006 11:31:38 +0000 From: andrewg@felinemenace.org To: gentoo-hardened@lists.gentoo.org Subject: Re: [gentoo-hardened] Grsec and shutdown (unable to umount / ) Message-ID: <20060207113138.GC8265@pluto> References: <1139194319.32088.8.camel@neuromancer.home.net> <20060206204412.GB8265@pluto> <1139272723.10903.5.camel@neuromancer.home.net> Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-hardened@gentoo.org Reply-to: gentoo-hardened@lists.gentoo.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1139272723.10903.5.camel@neuromancer.home.net> User-Agent: Mutt/1.5.11 X-Archives-Salt: 42fa5dd7-6228-49ca-9b31-edab9c7655e3 X-Archives-Hash: 4b22bd768e98c8a9fb00df44d6b814cb > > > > > > I just want to verify if there is anyone here who also suffers this and > > > what are the proper/needed steps to avoid this? (it's really painful to > > > have to remember this and do a gradm -D each time) > > > > > > > If you have the sshd flag marked as protected > > Huh. Please elaborate. I'm new to using a hardened kernel/toolchain etc. > (but not new to gentoo) > http://grsecurity.net/gracldoc.htm >>From the sample policy file that ships with grsec, # the d flag protects /proc fd and mem entries for sshd # all daemons should have 'p' in their subject mode to prevent # an attacker from killing the service (and restarting it with trojaned # config file or taking the port it reserved to run a trojaned service) subject /usr/sbin/sshd dpo > > I get it. I didn't try to see if SSHD was still running. I'll give it > another go when I get a chance. > Thanks, Andrew Griffiths -- gentoo-hardened@gentoo.org mailing list