wiki:experiences:igraltist:jail_cron
=>  Releases

Current version
Git/Latestdiff: 1.5.6

Latest Snapshots
Produced after each commit or rebase to new upstream version

GIT
RSBAC source code, can be unstable sometimes

=>  Events

No events planned

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision Both sides next revision
wiki:experiences:igraltist:jail_cron [2008/07/12 06:22]
127.0.0.1 (old revision restored)
wiki:experiences:igraltist:jail_cron [2008/07/12 06:31]
127.0.0.1 (old revision restored)
Line 102: Line 102:
  
 For this a speed up the clock (only virtual :-)) to next cronjobs For this a speed up the clock (only virtual :-)) to next cronjobs
 +
 ===== =====
 +Now it is 6:25 am and standard cronjobs is starting and on the terminal i see this.
 +
 +   <​6>​0000001241|rsbac_adf_request():​ request MODIFY_SYSTEM_DATA,​ pid 4732, ppid 4716, prog_name cron, prog_file /​usr/​sbin/​cron,​ uid 0, remote ip 192.168.1.5,​ target_type SCD, tid rlimit, attr none, value none, result NOT_GRANTED by JAIL
 +
 +always the same, search for target_type ​
 +   ​target_type SCD :: request MODIFY_SYSTEM_DATA :: tid rlimit
 +
 +the target_type change to SCD so now I have to use this [[wiki:​experiences/​igraltist/​jail_flags|scd_flags]].
 +
 +The request says it need MODIFY_SYSTEM_DATA this means the categorie four () and rlimit is need.
 +
 +The MODIFY_SYSTEM_DATA and GET_SYSTEM_DATA have the same scd_flags only the categories are different.
 +If GET_SYSTEM_DATA is requested then rsbac_jail -G is need otherwise -M for MODIFY.
 +
 +
 +I add now to cron in categorie four rlimit
 +   ​(allow-ipc-syslog
 +    allow-dev-write
 +    allow-dev-read)
 +   ()
 +   ()
 +   ​(rlimit)
 +
 +   <​6>​0000001269|rsbac_adf_request():​ request GET_STATUS_DATA,​ pid 4813, ppid 4807, prog_name df, prog_file /bin/df, uid 0, remote ip 192.168.1.5,​ target_type DEV, tid block 08:01, attr none, value none, result NOT_GRANTED by JAIL
 +
 +search for target_type,​
 +    target_type DEV :: request GET_STATUS_DATA (tid not important in this case)
 +
 +rsbac_jail says,
 +   \- stupid wiki
 +   -e = allow GET_STATUS_DATA on devices,
 +
 +this is a jail_flag, so in the first categorie i add '​allow-dev-get-status'​
 +   ​(allow-ipc-syslog
 +    allow-dev-write
 +    allow-dev-read ​
 +    allow-dev-get-status)
 +   ()
 +   ()
 +   ​(rlimit)
  
  
 +   <​6>​0000001300|rsbac_adf_request():​ request SEND_SIGNAL,​ pid 4831, ppid 4830, prog_name syslogd, prog_file /​sbin/​syslogd,​ uid 0, remote ip 192.168.1.5,​ target_type PROCESS, tid 4384, attr none, value none, result NOT_GRANTED by JAIL
 +  ​
 +   Is never allow in the jail
 +  ​
  
 +   <​7>​0000001301|rsbac_adf_request_jail():​ process jail 57 does not match IPC object jail 56 -> NOT_GRANTED!
 +   <​6>​0000001302|rsbac_adf_request():​ request WRITE, pid 4831, ppid 4830, prog_name syslogd, prog_file /​sbin/​syslogd,​ uid 0, remote ip 192.168.1.5,​ target_type IPC, tid AnonPipe-ID 10243, attr none, value none, result NOT_GRANTED by JAIL
  
 +This have again a jail_flag, and here is the '​allow-external-ipc'​ needed
 +   ​(allow-ipc-syslog
 +    allow-dev-write
 +    allow-dev-read ​
 +    allow-dev-get-status
 +    allow-external-ipc)
 +   ()
 +   ()
 +   ​(rlimit)
  
  
//
wiki/experiences/igraltist/jail_cron.txt · Last modified: 2008/07/12 06:35 by 127.0.0.1

wiki/experiences/igraltist/jail_cron.txt · Last modified: 2008/07/12 06:35 by 127.0.0.1
This website is kindly hosted by m-privacy