grsecurity forums

by **osea** » Fri Feb 24, 2017 10:36 pm

Changed the binaries under the following roles:

Code: Select all: # Role: libvirt-qemu subject /usr/sbin/libvirtd O {

Code: Select all: # Role: root subject /usr/sbin/libvirtd O { user_transition_allow libvirt-qemu nobody group_transition_allow libvirt-qemu nogroup

Code: Select all: # Role: root subject /usr/lib/libvirt/virt-aa-helper O {

Activated subject learning with:

Code: Select all: sudo gradm -L /etc/grsec/learning.logs -E

I get different warnings:

Code: Select all: debian kernel: [105716] grsec: (root:U:/sbin/gradm) grsecurity 3.1 RBAC system loaded by /sbin/gradm[gradm:4484] uid/euid:0/0 gid/egid:0/0, parent /usr/bin/sudo[sudo:4483] uid/euid:0/0 gid/egid:0/0 debian kernel: [105716] grsec: (root:U:/usr/sbin/libvirtd) denied open of /sys/devices/system/cpu/present for reading by /usr/sbin/libvirtd[libvirtd:796] uid/euid:0/0 gid/egid:0/0, parent /lib/systemd/systemd[systemd:1] uid/euid:0/0 gid/egid:0/0 debian libvirtd[773]: 796: error : virFileReadAll:1388 : Failed to open file '/sys/devices/system/cpu/present': Permission denied debian libvirtd[773]: 803: error : virGetUserEnt:803 : Failed to find user record for uid '1000': No such file or directory debian libvirtd[773]: 773: error : virNetSocketReadWire:1801 : End of file while reading data: Input/output error

by **timbgo** » Sat Feb 25, 2017 5:48 pm

I'll try and reply to you (but my knowledge is limited too).
Pls. notice the "adding".

spender wrote:Try adding "O" (capital o) to the subject mode for /usr/sbin/libvirtd. I'm guessing you have a separate subject for /usr/lib/libvirt/virt-aa-helper?

-Brad

So this is not right, because this is replacing:

osea wrote:Changed the binaries under the following roles:

Code: Select all
# Role: libvirt-qemu subject /usr/sbin/libvirtd O {

Code: Select all
# Role: root subject /usr/sbin/libvirtd O { user_transition_allow libvirt-qemu nobody group_transition_allow libvirt-qemu nogroup

Code: Select all
# Role: root subject /usr/lib/libvirt/virt-aa-helper O {

You should try adding "O", not replacing the "o" with "O".

Activated subject learning with:

Code: Select all
sudo gradm -L /etc/grsec/learning.logs -E

I get different warnings:

Code: Select all
debian kernel: [105716] grsec: (root:U:/sbin/gradm) grsecurity 3.1 RBAC system loaded by /sbin/gradm[gradm:4484] uid/euid:0/0 gid/egid:0/0, parent /usr/bin/sudo[sudo:4483] uid/euid:0/0 gid/egid:0/0 debian kernel: [105716] grsec: (root:U:/usr/sbin/libvirtd) denied open of /sys/devices/system/cpu/present for reading by /usr/sbin/libvirtd[libvirtd:796] uid/euid:0/0 gid/egid:0/0, parent /lib/systemd/systemd[systemd:1] uid/euid:0/0 gid/egid:0/0 debian libvirtd[773]: 796: error : virFileReadAll:1388 : Failed to open file '/sys/devices/system/cpu/present': Permission denied debian libvirtd[773]: 803: error : virGetUserEnt:803 : Failed to find user record for uid '1000': No such file or directory debian libvirtd[773]: 773: error : virNetSocketReadWire:1801 : End of file while reading data: Input/output error

So add O to o, or if you like, replace the "o" with "oO" (or I guess "Oo" is fine as well). And see what you get. And tell us.

By the way, I'm slow, even if I will try and reply to you. Pls. notice that it really took me long, and just the work of the last two days
(
but the fix btwn the No 8 and No 9 below is about setting up bridge with iproute2 in OpenRC, and using /usr/libexec/qemu-bridge-helper correctly... so it's unrelated to here -- the fix itself btwn No 8 and No 9... the pages _are_ related to here, as I did have grsecurity enabled in my VM Devuan, proper and Refracta on No 9
)
Do notice that it really took me long, just the last two days of my work:

Devuan image in Qemu (8)
https://www.croatiafidelis.hr/foss/cap/ ... vuan-8.php

Devuan image in Qemu (9)
https://www.croatiafidelis.hr/foss/cap/ ... vuan-9.php

It's hard, but don't give up. Those pages over at:

https://en.wikibooks.org/wiki/Grsecurity

are great, I read them over a few times, maybe a couple of times every last two or three years, and still need to refresh.

Regards!

by **osea** » Sat Feb 25, 2017 10:31 pm

Changed to oO:

Code: Select all: debian kernel: [ 310] grsec: (root:U:/usr/sbin/libvirtd) denied access to hidden file /usr/share/augeas/lenses/dist/interfaces.aug by /usr/sbin/libvirtd[libvirtd:799] uid/euid:0/0 gid/egid:0/0, parent /lib/systemd/systemd[systemd:1] uid/euid:0/0 gid/egid:0/0 debian kernel: [ 310] grsec: (root:U:/usr/sbin/libvirtd) denied access to hidden file /usr/share/augeas/lenses/dist/modprobe.aug by /usr/sbin/libvirtd[libvirtd:799] uid/euid:0/0 gid/egid:0/0, parent /lib/systemd/systemd[systemd:1] uid/euid:0/0 gid/egid:0/0 debian kernel: [ 310] grsec: (root:U:/usr/sbin/libvirtd) denied access to hidden file /usr/share/netcf/lenses/netcf.aug by /usr/sbin/libvirtd[libvirtd:799] uid/euid:0/0 gid/egid:0/0, parent /lib/systemd/systemd[systemd:1] uid/euid:0/0 gid/egid:0/0 debian libvirtd[779]: : 799: error : netcfConnectNumOfInterfacesImpl:287 : internal error: failed to get number of host interfaces: unspecified error - errors in loading some config files debian libvirtd[779]: : 800: error : netcfConnectListAllInterfaces:563 : internal error: failed to get number of host interfaces: unspecified error - errors in loading some config files debian libvirtd[779]: : 808: error : netcfConnectListAllInterfaces:563 : internal error: failed to get number of host interfaces: unspecified error - errors in loading some config files debian kernel: [ 310] grsec: (root:U:/usr/sbin/libvirtd) denied access to hidden file /usr/share/augeas/lenses/dist/interfaces.aug by /usr/sbin/libvirtd[libvirtd:800] uid/euid:0/0 gid/egid:0/0, parent /lib/systemd/systemd[systemd:1] uid/euid:0/0 gid/egid:0/0 debian kernel: [ 310] grsec: (root:U:/usr/sbin/libvirtd) denied access to hidden file /usr/share/augeas/lenses/dist/modprobe.aug by /usr/sbin/libvirtd[libvirtd:800] uid/euid:0/0 gid/egid:0/0, parent /lib/systemd/systemd[systemd:1] uid/euid:0/0 gid/egid:0/0 debian kernel: [ 310] grsec: (root:U:/usr/sbin/libvirtd) denied access to hidden file /usr/share/netcf/lenses/netcf.aug by /usr/sbin/libvirtd[libvirtd:800] uid/euid:0/0 gid/egid:0/0, parent /lib/systemd/systemd[systemd:1] uid/euid:0/0 gid/egid:0/0 debian kernel: [ 310] grsec: (root:U:/usr/sbin/libvirtd) denied access to hidden file /usr/share/augeas/lenses/dist/interfaces.aug by /usr/sbin/libvirtd[libvirtd:808] uid/euid:0/0 gid/egid:0/0, parent /lib/systemd/systemd[systemd:1] uid/euid:0/0 gid/egid:0/0 debian kernel: [ 310] grsec: more alerts, logging disabled for 10 seconds debian libvirtd[779]: : 803: error : virCommandWait:2572 : internal error: Child process (LIBVIRT_LOG_OUTPUTS=3:stderr /usr/lib/libvirt/virt-aa-helper -p 0 -r -u libvirt-UID) unexpected exit status 126: libvirt: error : cannot execute binary /usr/lib/libvirt/virt-aa-helper: Permission denied debian libvirtd[779]: : 803: error : AppArmorGenSecurityLabel:486 : internal error: cannot load AppArmor profile 'libvirt-UID' debian systemd[1]: Started Virtual machine log manager. debian systemd[2043]: virtlogd.service: Failed at step EXEC spawning /usr/sbin/virtlogd: Permission denied debian systemd[1]: virtlogd.service: Main process exited, code=exited, status=203/EXEC debian systemd[1]: virtlogd.service: Unit entered failed state. debian systemd[1]: virtlogd.service: Failed with result 'exit-code'. debian systemd[1]: Started Virtual machine log manager. debian systemd[2045]: virtlogd.service: Failed at step EXEC spawning /usr/sbin/virtlogd: Permission denied debian systemd[1]: virtlogd.service: Main process exited, code=exited, status=203/EXEC debian systemd[1]: virtlogd.service: Unit entered failed state. debian systemd[1]: virtlogd.service: Failed with result 'exit-code'. debian systemd[1]: Started Virtual machine log manager. debian systemd[2046]: virtlogd.service: Failed at step EXEC spawning /usr/sbin/virtlogd: Permission denied debian systemd[1]: virtlogd.service: Main process exited, code=exited, status=203/EXEC debian systemd[1]: virtlogd.service: Unit entered failed state. debian systemd[1]: virtlogd.service: Failed with result 'exit-code'. debian systemd[1]: Started Virtual machine log manager. debian systemd[2049]: virtlogd.service: Failed at step EXEC spawning /usr/sbin/virtlogd: Permission denied debian systemd[1]: virtlogd.service: Main process exited, code=exited, status=203/EXEC debian systemd[1]: virtlogd.service: Unit entered failed state. debian systemd[1]: virtlogd.service: Failed with result 'exit-code'. debian systemd[1]: Started Virtual machine log manager. debian systemd[2051]: virtlogd.service: Failed at step EXEC spawning /usr/sbin/virtlogd: Permission denied debian systemd[1]: virtlogd.service: Main process exited, code=exited, status=203/EXEC debian systemd[1]: virtlogd.service: Unit entered failed state. debian systemd[1]: virtlogd.service: Failed with result 'exit-code'. debian systemd[1]: virtlogd.service: Start request repeated too quickly. debian libvirtd[779]: : 803: error : virNetSocketReadWire:1793 : Cannot recv data: Connection reset by peer debian systemd[1]: Failed to start Virtual machine log manager. debian systemd[1]: virtlogd.socket: Unit entered failed state. debian systemd[1]: virtlogd.service: Failed with result 'exit-code'. debian libvirtd[779]: : 801: error : netcfConnectNumOfInterfacesImpl:287 : internal error: failed to get number of host interfaces: unspecified error - errors in loading some config files debian libvirtd[779]: : 806: error : netcfConnectListAllInterfaces:563 : internal error: failed to get number of host interfaces: unspecified error - errors in loading some config files debian libvirtd[779]: : 799: error : netcfConnectListAllInterfaces:563 : internal error: failed to get number of host interfaces: unspecified error - errors in loading some config files debian kernel: [ 327] grsec: (user:U:/usr/share/virt-manager/virt-manager) denied access to hidden file /home/user by /usr/share/virt-manager/virt-manager[virt-manager:1999] uid/euid:1000/1000 gid/egid:1000/1000, parent /lib/systemd/systemd[systemd:1] uid/euid:0/0 gid/egid:0/0 debian kernel: [ 327] grsec: (user:U:/usr/share/virt-manager/virt-manager) denied access to hidden file /home/user by /usr/share/virt-manager/virt-manager[virt-manager:2003] uid/euid:1000/1000 gid/egid:1000/1000, parent /lib/systemd/systemd[systemd:1] uid/euid:0/0 gid/egid:0/0

by **timbgo** » Sun Feb 26, 2017 12:10 am

And it's a little clearer where the issues might be.

Not clear. And it can't be clear completely to me, because I currently don't run a Debian based/derivative system.

However, ducking with the ddg.gg for your files on which the "grsec: ... denied ..." cries out, I find some of them:

https://www.archlinux.org/packages/comm ... eas/files/
https://www.archlinux.org/packages/comm ... tcf/files/

and it is likely to be similar in Debian (I couldn't find it in:
https://packages.debian.org/jessie/admin/netcf
https://packages.debian.org/jessie/admin/augeas-tools
and other packages, I think libaugeas or so, don't know why).

Pls. compare if you can see entries from your log below into the links that I gave above. It's something you need figure out.

osea wrote:Changed to oO:
Code: Select all
debian kernel: [ 310] grsec: (root:U:/usr/sbin/libvirtd) denied access to hidden file /usr/share/augeas/lenses/dist/interfaces.aug by /usr/sbin/libvirtd[libvirtd:799] uid/euid:0/0 gid/egid:0/0, parent /lib/systemd/systemd[systemd:1] uid/euid:0/0 gid/egid:0/0 debian kernel: [ 310] grsec: (root:U:/usr/sbin/libvirtd) denied access to hidden file /usr/share/augeas/lenses/dist/modprobe.aug by /usr/sbin/libvirtd[libvirtd:799] uid/euid:0/0 gid/egid:0/0, parent /lib/systemd/systemd[systemd:1] uid/euid:0/0 gid/egid:0/0 debian kernel: [ 310] grsec: (root:U:/usr/sbin/libvirtd) denied access to hidden file /usr/share/netcf/lenses/netcf.aug by /usr/sbin/libvirtd[libvirtd:799] uid/euid:0/0 gid/egid:0/0, parent /lib/systemd/systemd[systemd:1] uid/euid:0/0 gid/egid:0/0 debian libvirtd[779]: : 799: error : netcfConnectNumOfInterfacesImpl:287 : internal error: failed to get number of host interfaces: unspecified error - errors in loading some config files debian libvirtd[779]: : 800: error : netcfConnectListAllInterfaces:563 : internal error: failed to get number of host interfaces: unspecified error - errors in loading some config files debian libvirtd[779]: : 808: error : netcfConnectListAllInterfaces:563 : internal error: failed to get number of host interfaces: unspecified error - errors in loading some config files debian kernel: [ 310] grsec: (root:U:/usr/sbin/libvirtd) denied access to hidden file /usr/share/augeas/lenses/dist/interfaces.aug by /usr/sbin/libvirtd[libvirtd:800] uid/euid:0/0 gid/egid:0/0, parent /lib/systemd/systemd[systemd:1] uid/euid:0/0 gid/egid:0/0 debian kernel: [ 310] grsec: (root:U:/usr/sbin/libvirtd) denied access to hidden file /usr/share/augeas/lenses/dist/modprobe.aug by /usr/sbin/libvirtd[libvirtd:800] uid/euid:0/0 gid/egid:0/0, parent /lib/systemd/systemd[systemd:1] uid/euid:0/0 gid/egid:0/0 debian kernel: [ 310] grsec: (root:U:/usr/sbin/libvirtd) denied access to hidden file /usr/share/netcf/lenses/netcf.aug by /usr/sbin/libvirtd[libvirtd:800] uid/euid:0/0 gid/egid:0/0, parent /lib/systemd/systemd[systemd:1] uid/euid:0/0 gid/egid:0/0 debian kernel: [ 310] grsec: (root:U:/usr/sbin/libvirtd) denied access to hidden file /usr/share/augeas/lenses/dist/interfaces.aug by /usr/sbin/libvirtd[libvirtd:808] uid/euid:0/0 gid/egid:0/0, parent /lib/systemd/systemd[systemd:1] uid/euid:0/0 gid/egid:0/0 debian kernel: [ 310] grsec: more alerts, logging disabled for 10 seconds debian libvirtd[779]: : 803: error : virCommandWait:2572 : internal error: Child process (LIBVIRT_LOG_OUTPUTS=3:stderr /usr/lib/libvirt/virt-aa-helper -p 0 -r -u libvirt-UID) unexpected exit status 126: libvirt: error : cannot execute binary /usr/lib/libvirt/virt-aa-helper: Permission denied debian libvirtd[779]: : 803: error : AppArmorGenSecurityLabel:486 : internal error: cannot load AppArmor profile 'libvirt-UID' debian systemd[1]: Started Virtual machine log manager. debian systemd[2043]: virtlogd.service: Failed at step EXEC spawning /usr/sbin/virtlogd: Permission denied debian systemd[1]: virtlogd.service: Main process exited, code=exited, status=203/EXEC debian systemd[1]: virtlogd.service: Unit entered failed state. debian systemd[1]: virtlogd.service: Failed with result 'exit-code'. debian systemd[1]: Started Virtual machine log manager. debian systemd[2045]: virtlogd.service: Failed at step EXEC spawning /usr/sbin/virtlogd: Permission denied debian systemd[1]: virtlogd.service: Main process exited, code=exited, status=203/EXEC debian systemd[1]: virtlogd.service: Unit entered failed state. debian systemd[1]: virtlogd.service: Failed with result 'exit-code'. debian systemd[1]: Started Virtual machine log manager. debian systemd[2046]: virtlogd.service: Failed at step EXEC spawning /usr/sbin/virtlogd: Permission denied debian systemd[1]: virtlogd.service: Main process exited, code=exited, status=203/EXEC debian systemd[1]: virtlogd.service: Unit entered failed state. debian systemd[1]: virtlogd.service: Failed with result 'exit-code'. debian systemd[1]: Started Virtual machine log manager. debian systemd[2049]: virtlogd.service: Failed at step EXEC spawning /usr/sbin/virtlogd: Permission denied debian systemd[1]: virtlogd.service: Main process exited, code=exited, status=203/EXEC debian systemd[1]: virtlogd.service: Unit entered failed state. debian systemd[1]: virtlogd.service: Failed with result 'exit-code'. debian systemd[1]: Started Virtual machine log manager. debian systemd[2051]: virtlogd.service: Failed at step EXEC spawning /usr/sbin/virtlogd: Permission denied debian systemd[1]: virtlogd.service: Main process exited, code=exited, status=203/EXEC debian systemd[1]: virtlogd.service: Unit entered failed state. debian systemd[1]: virtlogd.service: Failed with result 'exit-code'. debian systemd[1]: virtlogd.service: Start request repeated too quickly. debian libvirtd[779]: : 803: error : virNetSocketReadWire:1793 : Cannot recv data: Connection reset by peer debian systemd[1]: Failed to start Virtual machine log manager. debian systemd[1]: virtlogd.socket: Unit entered failed state. debian systemd[1]: virtlogd.service: Failed with result 'exit-code'. debian libvirtd[779]: : 801: error : netcfConnectNumOfInterfacesImpl:287 : internal error: failed to get number of host interfaces: unspecified error - errors in loading some config files debian libvirtd[779]: : 806: error : netcfConnectListAllInterfaces:563 : internal error: failed to get number of host interfaces: unspecified error - errors in loading some config files debian libvirtd[779]: : 799: error : netcfConnectListAllInterfaces:563 : internal error: failed to get number of host interfaces: unspecified error - errors in loading some config files debian kernel: [ 327] grsec: (user:U:/usr/share/virt-manager/virt-manager) denied access to hidden file /home/user by /usr/share/virt-manager/virt-manager[virt-manager:1999] uid/euid:1000/1000 gid/egid:1000/1000, parent /lib/systemd/systemd[systemd:1] uid/euid:0/0 gid/egid:0/0 debian kernel: [ 327] grsec: (user:U:/usr/share/virt-manager/virt-manager) denied access to hidden file /home/user by /usr/share/virt-manager/virt-manager[virt-manager:2003] uid/euid:1000/1000 gid/egid:1000/1000, parent /lib/systemd/systemd[systemd:1] uid/euid:0/0 gid/egid:0/0

The very last message in the snippet from the log that you pasted is unrelated to the above packages:

Code: Select all: debian kernel: [ 327] grsec: (user:U:/usr/share/virt-manager/virt-manager) denied access to hidden file /home/user by /usr/share/virt-manager/virt-manager[virt-manager:2003] uid/euid:1000/1000 gid/egid:1000/1000, parent /lib/systemd/systemd[systemd:1] uid/euid:0/0 gid/egid:0/0

This /home/user is likely /home/<you>.
And /usr/share/virt-manager/virt-manager binary needs likely rwc or even rwcdl access to it. See in my policies what permissions libvirtd and other packages needed to be given on /home/miro. (Just remember it's best that it be learned.)

What you should do is list, for yourself, those files, try and understand what their function is, why libvirt depends on them, e.g.:
https://packages.debian.org/source/jessie/libvirt
as it is likely that the error messages are caused by what reads in the "... denied ..." lines.

And then enable what's missing in those. It's hard to tell exactly what to do, because I can't install Debian just to be able to solve this issue.

But something like, and in the right subject, this:

Code: Select all: /usr/share/augeas/lenses/dist r

for /usr/share/augeas/lenses/dist/interfaces.aug
and even some additions into whatever holds the subject/object (I have run away from Debian as soon as systemd became the default):

Code: Select all: /lib/systemd/systemd

is likely in the order...

However, it might be that you followed my steps too closely. Gentoo and Debian are not very similar distibutions at all... Well, they share the basis of course, but diverge greatly. Esp. now that Debian is systemd based, and Gentoo is OpenRC based in its default installation.

Did you apply your own learning or did you, in part, paste from my policies? (pls. don't skip replying here)

At this stage, maybe something like what I did back some two years ago might be useful:
A no-poetterware desktop RBAC policy
viewtopic.php?f=5&t=4153
LATER EDIT: What I mean: maybe, that's first. And second, a litlle more likely to get someone to scrutinize your entire policies if all is available for viewing. If I were where roughly you are with your understanding currently, I would make a separate topic, and post my entire policy file. Also just: maybe that would help, as there are lots of people using systemd-based distros, esp. Debian and Debian derivatives.

I know it's a lot of work. I know because it took me huge time to figure things out. Look up the date that I posted that policy of mine. I couldn't dream of getting online with Virtual Machines and still be protected by my grsecurity-hardened kernel back then like I can do today...

Regards!

by **timbgo** » Sun Feb 26, 2017 2:33 am

Dear Lord, I think I see just a little better where more of the problems lie.

Looking at these:

osea wrote:Changed the binaries under the following roles:

Code: Select all
# Role: libvirt-qemu subject /usr/sbin/libvirtd O {

Code: Select all
# Role: root subject /usr/sbin/libvirtd O { user_transition_allow libvirt-qemu nobody group_transition_allow libvirt-qemu nogroup

Code: Select all
# Role: root subject /usr/lib/libvirt/virt-aa-helper O {

The above, or if you did later (the following is assumption not a real quote):

Code: Select all
# Role: libvirt-qemu subject /usr/sbin/libvirtd oO {

Code: Select all
# Role: root subject /usr/sbin/libvirtd oO { user_transition_allow libvirt-qemu nobody group_transition_allow libvirt-qemu nogroup

Code: Select all
# Role: root subject /usr/lib/libvirt/virt-aa-helper oO {

did not do and could not do any learning like you thought!

Activated subject learning with:

Code: Select all
sudo gradm -L /etc/grsec/learning.logs -E

because what was missing is the l flag.
That should be:

Code: Select all
# Role: libvirt-qemu subject /usr/sbin/libvirtd oOl {

Code: Select all
# Role: root subject /usr/sbin/libvirtd oOl { user_transition_allow libvirt-qemu nobody group_transition_allow libvirt-qemu nogroup

Code: Select all
# Role: root subject /usr/lib/libvirt/virt-aa-helper oOl {

And only then you activate the learning with:

Code: Select all: sudo gradm -L /etc/grsec/learning.logs -E

by **timbgo** » Sun Feb 26, 2017 3:11 am

Also:

Code: Select all: ... debian libvirtd[779]: : 803: error : AppArmorGenSecurityLabel:486 : internal error: cannot load AppArmor profile 'libvirt-UID' ...

it, to me, does not appear the right way having been used at disabling AppArmor for libvirt, but I don't know, somebody who uses and knows AppArmor might tell us.

You surely would need to reread the documentation for grsecurity, from
https://en.wikibooks.org/wiki/Grsecurity
already linked in this topic, to man pages, to the tips in the /etc/grsec/ files and other. How the learning is set up is well documented on:
https://en.wikibooks.org/wiki/Grsecurit ... rning_Mode
and maybe also elsewhere.

And, if you go for pasting the entire policy, pls. open a separate topic. That cow wouldn't be worth only one steak. But once it is in a separate topic, non-related steaks could be made from that cow. If ever, who know how this will go.

by **timbgo** » Sun Feb 26, 2017 3:22 pm

I had changed my grsec policy a few more time since:

Code: Select all: ... +++ grsec_170215_g0n_02 2017-02-15 19:47:10.223011867 +0100

which is in post:
( this same topic )
viewtopic.php?f=5&t=4675#p16943

The changes since then (again, real output, real files) I got with this command:

Code: Select all: # > j_TMP ; j=$(cat j_TMP); for i in $(ls -1 ./ | grep grsec_17 | grep -A3000 grsec_170215_g0n_02|grep -v grsec_170.d| grep -v grsec_170224_g0n_01_abandoned ); do if [ -e "j_TMP" ]; then echo cat j_TMP; cat j_TMP; j=$(cat j_TMP); echo $j; read FAKE ; echo diff ./$j ./$i ; if [ ! -d "./${j}" ]; then echo diff ./$j ./$i ; echo |& tee -a /Cmn/m/B/Virt_170226/grsec_list_CMD.txt; echo "[b]diff -u35 ./$j ./$i[/b]" |& tee -a /Cmn/m/B/Virt_170226/grsec_list_CMD.txt ; echo |& tee -a /Cmn/m/B/Virt_170226/grsec_list_CMD.txt ; echo "[code]" |& tee -a /Cmn/m/B/Virt_170226/grsec_list_CMD.txt ; read FAKE; diff -u35 ./$j ./$i |& tee -a /Cmn/m/B/Virt_170226/grsec_list_CMD.txt ; echo "[/code]" |& tee -a /Cmn/m/B/Virt_170226/grsec_list_CMD.txt ; fi; fi; echo $i > j_TMP; cat j_TMP; read FAKE; done ;

The goodness is that is will be more readable now. The grsec_list_CMD.txt I just will paste into the next post! I'm betting it will work... Suspense... suspense...

by **timbgo** » Sun Feb 26, 2017 3:37 pm

Nope. I got:

Your message contains 75575 characters. The maximum number of allowed characters is 60000.

So I just removed manually some unimportant stretches (lots of it) in the third diff (completely unrelated to here). And it should work now:

diff -u35 ./grsec_170215_g0n_02 ./grsec_170217_g0n_02

Code: Select all: --- ./grsec_170215_g0n_02 2017-02-15 19:47:10.223011867 +0100 +++ ./grsec_170217_g0n_02 2017-02-17 22:31:03.000000000 +0100 @@ -234,70 +234,90 @@ ... # # Commonly-used objects can be defined and used in multiple subjects # As an example, we'll create a variable out of a list of objects # and their associated permissions that RBAC enforces # files, connect/bind rules, and capabilities can currently be added to a define define grsec_denied { /boot h /dev/grsec h /dev/kmem h /dev/mem h /dev/port h /etc/grsec h /proc/kcore h /proc/slabinfo h /proc/modules h /proc/kallsyms h # hide and suppress logs about accessing this path /lib/modules hs /lib32/modules hs /lib64/modules hs /etc/ssh h # usage: # $grsec_denied } +define gpg_programs { +/usr/bin/dirmngr rx +/usr/bin/gpg2 rx +/usr/bin/gpg-agent rx +/usr/bin/gpgconf rx +/usr/bin/gpg-connect-agent rx +/usr/bin/gpg-error rx +/usr/bin/gpgme-config rx +/usr/bin/gpgme-tool rx +/usr/bin/gpgparsemail rx +/usr/bin/gpgscm rx +/usr/bin/gpgsm rx +/usr/bin/gpgtar rx +/usr/bin/gpgv2 rx +/usr/bin/pinentry-curses rx +/usr/bin/pinentry-tty rx +# usage: +# $gpg_programs +} + role shutdown sARG subject / rvka / ... @@ -1852,71 +1872,73 @@ /etc/ld.so.cache r /etc/localtime r /etc/nsswitch.conf r /lib64 rx /lib64/modules h /run rw /sbin h /sbin/agetty x /usr h /usr/lib64/locale/locale-archive r /usr/share/locale r /var h /var/log/wtmp w -CAP_ALL +CAP_CHOWN +CAP_DAC_OVERRIDE +CAP_FSETID +CAP_SYS_ADMIN +CAP_SYS_TTY_CONFIG bind disabled connect disabled # Role: root subject /sbin/init o / h /bin /bin/login x /dev h /dev/console rw /dev/initctl rw /dev/log rw /run h /run/utmp rw /sbin h /sbin/agetty x - /usr/bin/gpg-agent r + /usr + /usr/bin + /usr/bin/gpg-agent rx /usr/sbin/conntrackd r /var h /var/log/wtmp w /var/lib/dhcpcd w -CAP_ALL +CAP_MKNOD bind disabled connect disabled # Role: root subject /sbin/installkernel o / h ... # Role: root subject /sbin/macchanger o / h @@ -2246,99 +2268,103 @@ / r /Cmn r /bin r /boot /dev /dev/grsec h /dev/kmem h /dev/log h /dev/mem h /dev/port h /etc r /etc/freshclam.conf r /etc/ld.so.cache r /export r /home /home/miro r /lib32 r /lib64 rx /lost+found /mnt r /opt /opt/icedtea-bin-* r /proc r /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /root r /run /sbin r /sys /tmp rwcd /usr r + /usr/arm-unknown-linux-gnueabi r /usr/bin rx /usr/lib64 rx /usr/local/bin rw /var r /var/log/clamav rwcd + /var/vdr r + /var/svc.d r -CAP_ALL +CAP_DAC_READ_SEARCH bind disabled connect disabled # Role: root subject /usr/bin/crontab o group_transition_allow root nobody / h /bin h /bin/bash x /etc h /etc/crontab r /etc/group r /etc/ld.so.cache r /etc/nsswitch.conf r /etc/passwd r /lib64 rx /lib64/modules h /proc h /proc/sys/kernel/ngroups_max r /root /tmp rwcd /usr h + /usr/arm-unknown-linux-gnueabi r /usr/bin/crontab x /var h /var/spool/cron rwcd -CAP_ALL +CAP_SETGID bind disabled connect disabled # Role: root subject /usr/bin/cvs o / h /Cmn/dLo rwcd ... @@ -3938,70 +3964,71 @@ ... # Role: root subject /usr/sbin/rkhunter o / r /bin x /dev /dev/grsec h /dev/kmem h /dev/log h /dev/mem h /dev/null rw /dev/port h /dev/tty rw /etc r /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/passwd h + /etc/shadow h /etc/shadow- h /etc/ssh h /etc/ssh/ssh_config /home h /home/miro /lib64 rx /opt /proc h /proc/meminfo r /root /sbin /usr /usr/bin x /usr/lib64 h /usr/lib64/gconv/gconv-modules.cache r /usr/lib64/locale/locale-archive r /usr/lib64/rkhunter/scripts /usr/local h /usr/local/bin r /usr/local/sbin r /usr/sbin /usr/sbin/rkhunter r /usr/share h /usr/share/locale r /usr/src h /usr/x86_64-pc-linux-gnu h /usr/x86_64-pc-linux-gnu/binutils-bin x /usr/x86_64-pc-linux-gnu/gcc-bin x /var h /var/lib/rkhunter/db w /var/lib/rkhunter/db/i18n /var/lib/rkhunter/tmp w /var/log w -CAP_ALL bind disabled @@ -4251,70 +4278,71 @@ +CAP_SETUID +CAP_SETPCAP +CAP_NET_ADMIN +CAP_NET_RAW bind disabled connect disabled sock_allow_family unix inet netlink # Role: root subject /usr/sbin/tripwire o user_transition_allow root group_transition_allow root / /boot r /bin rx /dev /dev/grsec h /dev/kmem h /dev/log rw /dev/port h /etc r /home /home/miro rwcd /lib rx /lib64 rx /opt /opt/icedtea-bin-* r /proc /proc/bus h /proc/kcore h /proc/slabinfo r /proc/sys h /root rwcd /sbin r /usr + /usr/arm-unknown-linux-gnueabi r /usr/bin r /usr/etc r /usr/lib64 rx /usr/libexec r /usr/local r /usr/sbin rx /usr/share r /usr/src h /usr/x86_64-pc-linux-gnu r /usr/arm-unknown-linux-gnueabi r /var /var/lib rwcd /var/spool h /var/spool/cron r /var/www r -CAP_ALL +CAP_DAC_OVERRIDE +CAP_DAC_READ_SEARCH +CAP_SETGID +CAP_SETUID bind disabled connect disabled ... @@ -4777,70 +4805,71 @@ /etc r /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/shadow h /etc/shadow- h /etc/ssh h /home /home/miro rwxcdl /lib/modules h /lib64 rx /lib64/modules h /mnt r /mnt/g* rwxcd /mnt/sr0 r /mnt/sd?1 rwxcdl /mnt/sr* r /opt /opt/cin x /opt/icedtea-bin-* rx /proc h /proc/meminfo r /sbin h /sbin/conntrack x /sbin/ldconfig x /sbin/macchanger /sbin/openrc /sbin/xtables-multi /sys h /tmp rwcd /usr /usr/bin x /usr/bin/java rx /usr/bin/mplayer rx /usr/bin/mpv rx + /usr/bin/qemu-system-x86_64 rx /usr/bin/ssh rx /usr/bin/xkbcomp rx /usr/bin/urxvt rx /usr/bin/tzap rx /usr/lib64 rx /usr/libexec rx /usr/local /usr/local/bin rwxc /usr/sbin h /usr/sbin/sendmail rx /usr/sbin/tcpdump x /usr/share h /usr/share/virt-manager x /usr/share/cvs/contrib/rcs2log /usr/share/doc r /usr/share/info r /usr/share/locale r /usr/share/terminfo r /usr/src rwxc # needed by youtube-dl /usr/x86_64-pc-linux-gnu/binutils-bin/2.25.1/objdump x /var /var/lib /var/lib/lurker rwcdl /var/log h /var/tmp rwcd /var/www /var/www/lurker* rwcd /var/www/localhost /var/www/localhost/htdocs rwcd -CAP_ALL bind disabled connect disabled sock_allow_family all @@ -5802,89 +5831,91 @@ ... # Role: miro subject /usr/bin/dirmngr o / /boot h /dev h /dev/null rw /dev/random /dev/urandom r /etc h /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/passwd h /etc/ppp h /etc/samba/smbpasswd h /etc/shadow h /etc/shadow- h /etc/ld.so.cache r /etc/nsswitch.conf r /etc/resolv.conf r /etc/ssh h /etc/ssl r # /etc/ssl/certs/ca-certificates.crt r /home h - /home/miro/.gnupg - /home/miro/.gnupg/S.dirmngr wcd - /home/miro/.gnupg/crls.d rwc - /home/miro/.gnupg/dirmngr.conf r + /home/miro/.gnupg rwcdl +# /home/miro/.gnupg +# /home/miro/.gnupg/S.dirmngr wcd +# /home/miro/.gnupg/crls.d rwc +# /home/miro/.gnupg/dirmngr.conf r /home/miro/.sslkey.log a /lib/modules h /lib64 rx /lib64/modules h /proc rw /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys/vm/overcommit_memory r /sys h /usr h /usr/bin h - /usr/bin/dirmngr rx + $gpg_programs +# /usr/bin/dirmngr rx /usr/lib64 rx /usr/share h /usr/share/gnupg r # /usr/share/gnupg/sks-keyservers.netCA.pem r /usr/share/locale r /var/log h -CAP_ALL bind 0.0.0.0/32:1024-65535 dgram ip udp bind 0.0.0.0/32:0 dgram ip udp connect 0.0.0.0/0:11371 stream dgram tcp udp connect 0.0.0.0/0:53 stream dgram tcp udp connect 127.0.0.1/32:9050 stream dgram tcp udp connect 127.0.0.1/32:9150 stream dgram tcp udp # connect 94.23.204.11/32:11371 stream tcp # connect 18.4.249.71/32:11371 stream tcp # connect 104.236.209.43/32:11371 stream tcp # connect 37.191.238.78/32:443 stream tcp # connect 5.9.49.12/32:53 dgram udp # connect 31.14.133.188/32:53 dgram udp # connect 81.2.237.32/32:53 dgram udp #from cca 5 days previous learning: # connect 51.15.53.138/32:11371 stream tcp # connect 185.95.216.79/32:11371 stream tcp # connect 209.15.13.134/32:11371 stream tcp # connect 217.69.77.222/32:11371 stream tcp # connect 18.9.60.141/32:11371 stream tcp # connect 176.9.51.79/32:11371 stream tcp # connect 134.93.178.170/32:11371 stream tcp # connect 202.141.176.99/32:11371 stream tcp # connect 37.191.238.78/32:11371 stream tcp # connect 37.120.166.149/32:11371 stream tcp # connect 37.250.89.239/32:11371 stream tcp # connect 5.9.49.12/32:53 stream dgram tcp udp # connect 31.14.133.188/32:53 dgram udp # connect 81.2.237.32/32:53 dgram udp @@ -6141,152 +6172,152 @@ /dev h /dev/null rw /dev/random /dev/urandom r /etc h /etc/ld.so.cache r /etc/localtime r /home h /home/miro/.gnupg rwcdl /home/miro/.gnupg/private-keys-v1.d rwcdl /lib/modules h /lib64 h /lib64/ld-2.23.so x /lib64/libc-2.23.so rx /lib64/libpthread-2.23.so rx /mnt /mnt/sdd1 r /mnt/sdd1/.gnupg rwcdl # /mnt/sdd1/.gnupg/S.gpg-agent rwcd # /mnt/sdd1/.gnupg/S.gpg-agent.browser wcd # /mnt/sdd1/.gnupg/S.gpg-agent.extra wcd # /mnt/sdd1/.gnupg/S.gpg-agent.ssh wcd # /mnt/sdd1/.gnupg/private-keys-v1.d rwc # /mnt/sdd1/.gnupg/private-keys-v1.d/61D5243CD1CF616EBE7F2BEE3E830811B6BDCF85.key r # /mnt/sdd1/.gnupg/private-keys-v1.d/69DCB3F7DFF03B916BFADC92F522F46A64565D92.key /proc /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /sys h /usr h /usr/bin h - /usr/bin/gpg-agent rx - /usr/bin/pinentry-curses x - /usr/bin/pinentry-tty x + $gpg_programs /usr/lib64 rx /usr/share h /usr/share/locale r /var/log h -CAP_ALL +CAP_FOWNER +CAP_MKNOD bind disabled connect disabled sock_allow_family unix inet -## Role: miro -#subject /usr/bin/gpg-connect-agent ol -# / h -# -CAP_ALL -# bind disabled -# connect disabled +# Role: miro +subject /usr/bin/gpg-connect-agent ol + / h + -CAP_ALL + bind disabled + connect disabled # Role: miro subject /usr/bin/gpg2 o / /Cmn h /Cmn/dLo rwc /Cmn/m* rwc /Cmn/src* rwc /boot h /dev h /dev/null rw /dev/pts /dev/random /dev/tty rw /dev/urandom r /etc h /etc/inputrc r /etc/ld.so.cache r /etc/localtime r /etc/terminfo /home h /home/miro rwcdl /home/miro/.gnupg rwcdl /lib/modules h /lib64 rx /lib64/modules h /mnt r /mnt/sdd1 rwcdl /mnt/sdd1/.gnupg rwcdl /proc /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /sys h /tmp r /usr h /usr/bin h - /usr/bin/dirmngr x - /usr/bin/gpg-agent x - /usr/bin/gpg2 rx + $gpg_programs /usr/lib64 rx /usr/share r /var/log h -CAP_ALL +CAP_FOWNER +CAP_MKNOD bind disabled connect disabled sock_allow_family unix inet # Role: miro subject /usr/bin/gpgconf o / h + /dev/null rw /etc h /etc/ld.so.cache r /lib64 h /lib64/ld-2.23.so x /lib64/libc-2.23.so rx /usr h + /usr/bin + $gpg_programs + /usr/share/locale r /usr/lib64/libgcrypt.so.20.1.5 rx /usr/lib64/libgpg-error.so.0.21.0 rx /usr/lib64/locale/locale-archive r -CAP_ALL bind disabled connect disabled ## Role: miro #subject /usr/bin/gpgparsemail ol # / h ... @@ -7026,73 +7057,78 @@ subject /usr/bin/qemu-system-x86_64 o / h /dev h /dev/kvm rw /dev/log rw /dev/shm /dev/shm/spice* rwcd /dev/urandom r /etc r /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/passwd h /etc/shadow h /etc/shadow- h /etc/ssh h /home h /home/miro rw /lib64 rx /lib64/modules h /proc r /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /usr h /usr/bin h /usr/bin/qemu-system-x86_64 rx /usr/lib64 rx /usr/share r /var h /var/cache h /var/cache/fontconfig r -CAP_ALL - bind disabled - connect disabled - sock_allow_family unix inet +# bind disabled +# connect disabled +# sock_allow_family unix inet + bind 0.0.0.0/32:0 dgram ip + connect 0.0.0.0/0:80 stream dgram tcp udp + connect 0.0.0.0/0:443 stream dgram tcp udp + connect 0.0.0.0/0:53 stream dgram tcp udp + sock_allow_family all # Role: miro subject /usr/libexec/qemu-bridge-helper o / h /dev h /dev/net/tun rw /etc h /etc/ld.so.cache r /etc/qemu/bridge.conf r /etc/qemu/miro.conf r /lib64 rx /lib64/modules h /proc /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /usr h /usr/lib64/libcap-ng.so.0 rx /usr/lib64/libcap-ng.so.0.0.0 rx /usr/lib64/libglib-2.0.so.0.4800.2 rx /usr/libexec/qemu-bridge-helper rx -CAP_ALL +CAP_NET_ADMIN bind disabled connect disabled sock_allow_family unix inet # Role: miro subject /usr/bin/readcd o user_transition_allow miro nobody / h /Cmn h

diff -u35 ./grsec_170217_g0n_02 ./grsec_170223_g0n_00

Code: Select all: --- ./grsec_170217_g0n_02 2017-02-17 22:31:03.000000000 +0100 +++ ./grsec_170223_g0n_00 2017-02-23 11:16:00.856486669 +0100 @@ -6177,127 +6177,129 @@ /etc/ld.so.cache r /etc/localtime r /home h /home/miro/.gnupg rwcdl /home/miro/.gnupg/private-keys-v1.d rwcdl /lib/modules h /lib64 h /lib64/ld-2.23.so x /lib64/libc-2.23.so rx /lib64/libpthread-2.23.so rx /mnt /mnt/sdd1 r /mnt/sdd1/.gnupg rwcdl # /mnt/sdd1/.gnupg/S.gpg-agent rwcd # /mnt/sdd1/.gnupg/S.gpg-agent.browser wcd # /mnt/sdd1/.gnupg/S.gpg-agent.extra wcd # /mnt/sdd1/.gnupg/S.gpg-agent.ssh wcd # /mnt/sdd1/.gnupg/private-keys-v1.d rwc # /mnt/sdd1/.gnupg/private-keys-v1.d/61D5243CD1CF616EBE7F2BEE3E830811B6BDCF85.key r # /mnt/sdd1/.gnupg/private-keys-v1.d/69DCB3F7DFF03B916BFADC92F522F46A64565D92.key /proc /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /sys h /usr h /usr/bin h $gpg_programs /usr/lib64 rx /usr/share h /usr/share/locale r /var/log h + /var/www/localhost/htdocs rwc -CAP_ALL +CAP_FOWNER +CAP_MKNOD bind disabled connect disabled sock_allow_family unix inet # Role: miro subject /usr/bin/gpg-connect-agent ol / h -CAP_ALL bind disabled connect disabled # Role: miro subject /usr/bin/gpg2 o / /Cmn h /Cmn/dLo rwc /Cmn/m* rwc /Cmn/src* rwc /boot h /dev h /dev/null rw /dev/pts /dev/random /dev/tty rw /dev/urandom r /etc h /etc/inputrc r /etc/ld.so.cache r /etc/localtime r /etc/terminfo /home h /home/miro rwcdl /home/miro/.gnupg rwcdl /lib/modules h /lib64 rx /lib64/modules h /mnt r /mnt/sdd1 rwcdl /mnt/sdd1/.gnupg rwcdl /proc /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /sys h /tmp r /usr h /usr/bin h $gpg_programs /usr/lib64 rx /usr/share r /var/log h + /var/www/localhost/htdocs rwc -CAP_ALL +CAP_FOWNER +CAP_MKNOD bind disabled connect disabled sock_allow_family unix inet # Role: miro subject /usr/bin/gpgconf o / h /dev/null rw /etc h /etc/ld.so.cache r /lib64 h /lib64/ld-2.23.so x /lib64/libc-2.23.so rx /usr h /usr/bin $gpg_programs /usr/share/locale r /usr/lib64/libgcrypt.so.20.1.5 rx /usr/lib64/libgpg-error.so.0.21.0 rx /usr/lib64/locale/locale-archive r -CAP_ALL bind disabled connect disabled ## Role: miro #subject /usr/bin/gpgparsemail ol # / h # -CAP_ALL # bind disabled # connect disabled ## Role: miro

diff -u35 ./grsec_170223_g0n_00 ./grsec_170223_g0n_01

Code: Select all: --- ./grsec_170223_g0n_00 2017-02-23 11:16:00.856486669 +0100 +++ ./grsec_170223_g0n_01 2017-02-23 11:40:59.791434518 +0100 @@ -639,70 +639,71 @@ ... @@ -826,70 +827,71 @@ ... @@ -1257,70 +1259,71 @@ ... @@ -4697,70 +4701,71 @@ ... @@ -4784,70 +4789,71 @@ ... @@ -4863,109 +4869,111 @@ ... @@ -5024,140 +5032,142 @@ ... @@ -5233,70 +5243,71 @@ ... @@ -5340,70 +5351,71 @@ ... @@ -5625,70 +5637,71 @@ ... @@ -6726,132 +6739,134 @@ ... @@ -7203,70 +7218,71 @@ ... @@ -7646,70 +7662,71 @@ ...

diff -u35 ./grsec_170223_g0n_01 ./grsec_170224_g0n_00

Code: Select all: --- ./grsec_170223_g0n_01 2017-02-23 11:40:59.791434518 +0100 +++ ./grsec_170224_g0n_00 2017-02-24 14:00:28.000000000 +0100 @@ -7081,70 +7081,71 @@ /dev/urandom r /etc r /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/passwd h /etc/shadow h /etc/shadow- h /etc/ssh h /home h /home/miro rw /lib64 rx /lib64/modules h /proc r /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /usr h /usr/bin h /usr/bin/qemu-system-x86_64 rx /usr/lib64 rx /usr/share r /var h /var/cache h /var/cache/fontconfig r -CAP_ALL # bind disabled # connect disabled # sock_allow_family unix inet bind 0.0.0.0/32:0 dgram ip connect 0.0.0.0/0:80 stream dgram tcp udp connect 0.0.0.0/0:443 stream dgram tcp udp connect 0.0.0.0/0:53 stream dgram tcp udp + connect 0.0.0.0/0:123 stream dgram tcp udp sock_allow_family all # Role: miro subject /usr/libexec/qemu-bridge-helper o / h /dev h /dev/net/tun rw /etc h /etc/ld.so.cache r /etc/qemu/bridge.conf r /etc/qemu/miro.conf r /lib64 rx /lib64/modules h /proc /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /usr h /usr/lib64/libcap-ng.so.0 rx /usr/lib64/libcap-ng.so.0.0.0 rx /usr/lib64/libglib-2.0.so.0.4800.2 rx /usr/libexec/qemu-bridge-helper rx -CAP_ALL +CAP_NET_ADMIN bind disabled connect disabled sock_allow_family unix inet # Role: miro subject /usr/bin/readcd o user_transition_allow miro nobody / h

diff -u35 ./grsec_170224_g0n_00 ./grsec_170224_g0n_02

Code: Select all: --- ./grsec_170224_g0n_00 2017-02-24 14:00:28.000000000 +0100 +++ ./grsec_170224_g0n_02 2017-02-24 15:21:31.000000000 +0100 @@ -7080,70 +7080,71 @@ /dev/shm/spice* rwcd /dev/urandom r /etc r /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/passwd h /etc/shadow h /etc/shadow- h /etc/ssh h /home h /home/miro rw /lib64 rx /lib64/modules h /proc r /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /usr h /usr/bin h /usr/bin/qemu-system-x86_64 rx /usr/lib64 rx /usr/share r /var h /var/cache h /var/cache/fontconfig r -CAP_ALL # bind disabled # connect disabled # sock_allow_family unix inet bind 0.0.0.0/32:0 dgram ip connect 0.0.0.0/0:80 stream dgram tcp udp connect 0.0.0.0/0:443 stream dgram tcp udp + connect 0.0.0.0/0:7 stream dgram tcp udp connect 0.0.0.0/0:53 stream dgram tcp udp connect 0.0.0.0/0:123 stream dgram tcp udp sock_allow_family all # Role: miro subject /usr/libexec/qemu-bridge-helper o / h /dev h /dev/net/tun rw /etc h /etc/ld.so.cache r /etc/qemu/bridge.conf r /etc/qemu/miro.conf r /lib64 rx /lib64/modules h /proc /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /usr h /usr/lib64/libcap-ng.so.0 rx /usr/lib64/libcap-ng.so.0.0.0 rx /usr/lib64/libglib-2.0.so.0.4800.2 rx /usr/libexec/qemu-bridge-helper rx -CAP_ALL +CAP_NET_ADMIN bind disabled connect disabled sock_allow_family unix inet # Role: miro subject /usr/bin/readcd o

diff -u35 ./grsec_170224_g0n_02 ./grsec_170224_g0n_03

Code: Select all: --- ./grsec_170224_g0n_02 2017-02-24 15:21:31.000000000 +0100 +++ ./grsec_170224_g0n_03 2017-02-24 19:26:09.000000000 +0100 @@ -6815,70 +6815,71 @@ /dev/dri/card0 rw /dev/null r /dev/snd rw /dev/urandom r /dev/zero rw /etc r /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/passwd h /etc/ppp h /etc/samba/smbpasswd h /etc/shadow h /etc/shadow- h /etc/ssh h /home /home/miro r /lib64 rx /lib64/modules h /mnt h /mnt/sd?1 r /mnt/g* r /mnt/H* r /mnt/sr* r /proc /proc/bus h /proc/cpuinfo r /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys/vm/overcommit_memory r /run h /run/udev/data r /sys h + /sys/dev/char r /sys/devices/pci0000:00 r /sys/devices/system/cpu /sys/devices/system/cpu/online r /usr h /usr/bin h /usr/bin/mpv rx /usr/bin/xdg-screensaver x /usr/lib64 rx /usr/share r /var h /var/cache h /var/cache/fontconfig r /var/www h /var/www/localhost h /var/www/localhost/htdocs r /var/www/localhost/htdocs/CroatiaFidelis r /var/www/localhost/htdocs/CroatiaFidelis/foss r /var/www/localhost/htdocs/CroatiaFidelis/foss/cap rwc -CAP_ALL bind disabled connect 192.168.2.0/24:80 stream tcp connect 127.0.0.1/32:80 stream tcp # Role: miro subject /usr/bin/mysql o / h /Cmn h /Cmn/m/Mdb r /dev h /dev/tty rw /etc r /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/passwd h

diff -u35 ./grsec_170224_g0n_03 ./grsec_170224_g0n_04

Code: Select all: --- ./grsec_170224_g0n_03 2017-02-24 19:26:09.000000000 +0100 +++ ./grsec_170224_g0n_04 2017-02-24 19:33:37.000000000 +0100 @@ -6796,108 +6796,109 @@ /var/www/localhost/htdocs r /var/www/localhost/htdocs/CroatiaFidelis r /var/www/localhost/htdocs/CroatiaFidelis/foss r /var/www/localhost/htdocs/CroatiaFidelis/foss/cap rwc -CAP_ALL bind 0.0.0.0/32:0 dgram ip connect 192.168.2.0/24:80 stream tcp connect 127.0.0.1/32:53 dgram udp sock_allow_family ipv6 # Role: miro subject /usr/bin/mpv o / h /Cmn r /Cmn/Kaff rwc /Cmn/dLo rwc /Cmn/mr rwc /dev h /dev/dri h /dev/dri/card0 rw /dev/null r /dev/snd rw /dev/urandom r /dev/zero rw /etc r /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/passwd h /etc/ppp h /etc/samba/smbpasswd h /etc/shadow h /etc/shadow- h /etc/ssh h /home - /home/miro r + /home/miro rwc /lib64 rx /lib64/modules h /mnt h /mnt/sd?1 r /mnt/g* r /mnt/H* r /mnt/sr* r /proc /proc/bus h /proc/cpuinfo r /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys/vm/overcommit_memory r /run h /run/udev/data r /sys h /sys/dev/char r /sys/devices/pci0000:00 r /sys/devices/system/cpu /sys/devices/system/cpu/online r /usr h /usr/bin h /usr/bin/mpv rx /usr/bin/xdg-screensaver x /usr/lib64 rx /usr/share r /var h /var/cache h /var/cache/fontconfig r /var/www h /var/www/localhost h /var/www/localhost/htdocs r - /var/www/localhost/htdocs/CroatiaFidelis r - /var/www/localhost/htdocs/CroatiaFidelis/foss r - /var/www/localhost/htdocs/CroatiaFidelis/foss/cap rwc + /var/www/localhost/htdocs/rovis_org r + /var/www/localhost/htdocs/rovis_org/CroatiaFidelis r + /var/www/localhost/htdocs/rovis_org/CroatiaFidelis/foss r + /var/www/localhost/htdocs/rovis_org/CroatiaFidelis/foss/cap rwc -CAP_ALL bind disabled connect 192.168.2.0/24:80 stream tcp connect 127.0.0.1/32:80 stream tcp # Role: miro subject /usr/bin/mysql o / h /Cmn h /Cmn/m/Mdb r /dev h /dev/tty rw /etc r /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/passwd h /etc/shadow h /etc/shadow- h /etc/ssh h /home h /home/miro rwcd /lib64 rx /lib64/modules h /run h /run/mysqld/mysqld.sock rw /usr h /usr/bin h /usr/bin/mysql rx /usr/lib64 rx /usr/share h /usr/share/mysql r /usr/share/terminfo r -CAP_ALL bind 0.0.0.0/32:0 dgram ip

diff -u35 ./grsec_170224_g0n_04 ./grsec_170225_g0n_00

Code: Select all: --- ./grsec_170224_g0n_04 2017-02-24 19:33:37.000000000 +0100 +++ ./grsec_170225_g0n_00 2017-02-25 01:13:42.000000000 +0100 @@ -4613,70 +4613,74 @@ /sys h /sys/devices/system/cpu/online r /usr h /usr/lib64 rx /usr/libexec x /var h /var/lib/postfix rwcd /var/spool/postfix rwcdl /var/tmp -CAP_ALL +CAP_DAC_READ_SEARCH +CAP_KILL +CAP_SETGID +CAP_SETUID bind 0.0.0.0/32:0 ip dgram stream tcp udp connect 127.0.0.1/32 ip dgram stream tcp udp connect 192.168.1.1/32:53 dgram udp connect 195.29.150.0/24 ip dgram stream tcp udp connect 178.218.165.68/32 ip dgram stream tcp udp sock_allow_family all # Role: postfix subject /usr/sbin/postsuper o user_transition_allow root group_transition_allow root / h /var/spool/postfix wd -CAP_ALL bind disabled connect disabled role qemu ul user_transition_allow root qemu group_transition_allow root kvm libvirt qemu +role qemu gl +user_transition_allow root qemu +group_transition_allow root kvm libvirt qemu + role tcpdump u subject / o / h -CAP_ALL bind disabled connect disabled # Role: tcpdump subject /usr/sbin/tcpdump o user_transition_allow miro root nobody tcpdump group_transition_allow miro root nobody tcpdump / h /Cmn rwc /etc h /etc/host.conf r /etc/hosts r /etc/ld.so.cache r /etc/resolv.conf r /lib64 h /lib64/libnss_dns-2.23.so rx /lib64/libresolv-2.23.so rx /lib64/libresolv.so.2 rx /proc r /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /usr h /usr/sbin/tcpdump rx -CAP_ALL +CAP_DAC_OVERRIDE bind 0.0.0.0/32:0 dgram ip connect 127.0.0.1/32:53 dgram udp @@ -7079,71 +7083,71 @@ /dev/kvm rw /dev/log rw /dev/shm /dev/shm/spice* rwcd /dev/urandom r /etc r /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/passwd h /etc/shadow h /etc/shadow- h /etc/ssh h /home h /home/miro rw /lib64 rx /lib64/modules h /proc r /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /usr h /usr/bin h /usr/bin/qemu-system-x86_64 rx /usr/lib64 rx /usr/share r /var h /var/cache h /var/cache/fontconfig r -CAP_ALL # bind disabled # connect disabled # sock_allow_family unix inet - bind 0.0.0.0/32:0 dgram ip + bind 0.0.0.0/32:0 ip dgram stream tcp udp connect 0.0.0.0/0:80 stream dgram tcp udp connect 0.0.0.0/0:443 stream dgram tcp udp connect 0.0.0.0/0:7 stream dgram tcp udp connect 0.0.0.0/0:53 stream dgram tcp udp connect 0.0.0.0/0:123 stream dgram tcp udp sock_allow_family all # Role: miro subject /usr/libexec/qemu-bridge-helper o / h /dev h /dev/net/tun rw /etc h /etc/ld.so.cache r /etc/qemu/bridge.conf r /etc/qemu/miro.conf r /lib64 rx /lib64/modules h /proc /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /usr h /usr/lib64/libcap-ng.so.0 rx /usr/lib64/libcap-ng.so.0.0.0 rx /usr/lib64/libglib-2.0.so.0.4800.2 rx /usr/libexec/qemu-bridge-helper rx -CAP_ALL +CAP_NET_ADMIN bind disabled connect disabled sock_allow_family unix inet

diff -u35 ./grsec_170225_g0n_00 ./grsec_170225_g0n_01

Code: Select all: --- ./grsec_170225_g0n_00 2017-02-25 01:13:42.000000000 +0100 +++ ./grsec_170225_g0n_01 2017-02-25 01:23:13.000000000 +0100 @@ -7088,70 +7088,72 @@ /etc r /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/passwd h /etc/shadow h /etc/shadow- h /etc/ssh h /home h /home/miro rw /lib64 rx /lib64/modules h /proc r /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /usr h /usr/bin h /usr/bin/qemu-system-x86_64 rx /usr/lib64 rx /usr/share r /var h /var/cache h /var/cache/fontconfig r -CAP_ALL # bind disabled # connect disabled # sock_allow_family unix inet bind 0.0.0.0/32:0 ip dgram stream tcp udp connect 0.0.0.0/0:80 stream dgram tcp udp connect 0.0.0.0/0:443 stream dgram tcp udp connect 0.0.0.0/0:7 stream dgram tcp udp connect 0.0.0.0/0:53 stream dgram tcp udp + connect 0.0.0.0/0:67 stream dgram tcp udp + connect 0.0.0.0/0:5353 stream dgram tcp udp connect 0.0.0.0/0:123 stream dgram tcp udp sock_allow_family all # Role: miro subject /usr/libexec/qemu-bridge-helper o / h /dev h /dev/net/tun rw /etc h /etc/ld.so.cache r /etc/qemu/bridge.conf r /etc/qemu/miro.conf r /lib64 rx /lib64/modules h /proc /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /usr h /usr/lib64/libcap-ng.so.0 rx /usr/lib64/libcap-ng.so.0.0.0 rx /usr/lib64/libglib-2.0.so.0.4800.2 rx /usr/libexec/qemu-bridge-helper rx -CAP_ALL +CAP_NET_ADMIN bind disabled connect disabled sock_allow_family unix inet # Role: miro subject /usr/bin/readcd o user_transition_allow miro nobody

diff -u35 ./grsec_170225_g0n_01 ./grsec_170225_g0n_02

Code: Select all: --- ./grsec_170225_g0n_01 2017-02-25 01:23:13.000000000 +0100 +++ ./grsec_170225_g0n_02 2017-02-25 01:30:46.000000000 +0100 @@ -7045,117 +7045,75 @@ /usr /usr/bin rx /usr/lib64 rx /usr/lib64/gconv h /usr/lib64/gconv/gconv-modules.cache r /usr/lib64/locale h /usr/lib64/locale/locale-archive r /usr/lib64/python3.4 r /usr/lib64/python3.4/collections h /usr/lib64/python3.4/collections/__init__.py /usr/lib64/python3.4/collections/__pycache__/__init__.cpython-34.pyc r /usr/lib64/python3.4/ctypes /usr/lib64/python3.4/ctypes/__pycache__ r /usr/lib64/python3.4/encodings /usr/lib64/python3.4/encodings/__pycache__ r /usr/lib64/python3.4/html /usr/lib64/python3.4/html/__pycache__ r /usr/lib64/python3.4/json /usr/lib64/python3.4/json/__pycache__ r /usr/lib64/python3.4/lib-dynload rx /usr/lib64/python3.4/site-packages r /usr/lib64/python3.4/site-packages/youtube_dl r /usr/lib64/python3.4/site-packages/youtube_dl/__pycache__ rwc /usr/lib64/python3.4/xml r /usr/lib64/python3.4/xml/etree /usr/lib64/python3.4/xml/etree/__pycache__ r /usr/src h -CAP_ALL bind 0.0.0.0/32:0 dgram ip # connect 104.237.172.22/32:443 stream dgram tcp udp # connect 192.168.1.1/32:53 dgram udp connect disabled sock_allow_family ipv6 netlink # Role: miro -subject /usr/bin/qemu-system-x86_64 o +subject /usr/bin/qemu-system-x86_64 ol / h - /dev h - /dev/kvm rw - /dev/log rw - /dev/shm - /dev/shm/spice* rwcd - /dev/urandom r - /etc r - /etc/grsec h - /etc/gshadow h - /etc/gshadow- h - /etc/passwd h - /etc/shadow h - /etc/shadow- h - /etc/ssh h - /home h - /home/miro rw - /lib64 rx - /lib64/modules h - /proc r - /proc/bus h - /proc/kallsyms h - /proc/kcore h - /proc/modules h - /proc/slabinfo h - /usr h - /usr/bin h - /usr/bin/qemu-system-x86_64 rx - /usr/lib64 rx - /usr/share r - /var h - /var/cache h - /var/cache/fontconfig r -CAP_ALL -# bind disabled -# connect disabled -# sock_allow_family unix inet - bind 0.0.0.0/32:0 ip dgram stream tcp udp - connect 0.0.0.0/0:80 stream dgram tcp udp - connect 0.0.0.0/0:443 stream dgram tcp udp - connect 0.0.0.0/0:7 stream dgram tcp udp - connect 0.0.0.0/0:53 stream dgram tcp udp - connect 0.0.0.0/0:67 stream dgram tcp udp - connect 0.0.0.0/0:5353 stream dgram tcp udp - connect 0.0.0.0/0:123 stream dgram tcp udp - sock_allow_family all + bind disabled + connect disabled # Role: miro subject /usr/libexec/qemu-bridge-helper o / h /dev h /dev/net/tun rw /etc h /etc/ld.so.cache r /etc/qemu/bridge.conf r /etc/qemu/miro.conf r /lib64 rx /lib64/modules h /proc /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /usr h /usr/lib64/libcap-ng.so.0 rx /usr/lib64/libcap-ng.so.0.0.0 rx /usr/lib64/libglib-2.0.so.0.4800.2 rx /usr/libexec/qemu-bridge-helper rx -CAP_ALL +CAP_NET_ADMIN bind disabled connect disabled sock_allow_family unix inet # Role: miro subject /usr/bin/readcd o user_transition_allow miro nobody / h /Cmn h

diff -u35 ./grsec_170225_g0n_02 ./grsec_170225_g0n_03

Code: Select all: --- ./grsec_170225_g0n_02 2017-02-25 01:30:46.000000000 +0100 +++ ./grsec_170225_g0n_03 2017-02-25 06:46:48.000000000 +0100 @@ -4980,70 +4980,72 @@ /etc/nsswitch.conf r /etc/resolv.conf r /lib64 rx /lib64/modules h /usr h /usr/lib64/locale/locale-archive r -CAP_ALL bind 0.0.0.0/32:0 dgram ip connect 127.0.0.1/32:53 dgram udp # Role: miro subject /bin/kill o / h /bin h /bin/kill x /etc h /etc/ld.so.cache r /lib64 rx /lib64/modules h /sys h /sys/devices/system/cpu/online r /usr h /usr/lib64/locale/locale-archive r /usr/share/locale r -CAP_ALL bind disabled connect disabled # Role: miro subject /bin/ls o / h /Cmn /bin h /bin/ls x /boot + /dev + /dev/kvm r /etc r /etc/grsec /etc/gshadow h /etc/gshadow- h /etc/shadow h /etc/shadow- h /etc/ssh h /home h /home/miro /lib64 rx /lib64/modules h /mnt /root /usr h /usr/bin r /usr/lib64 r /usr/local/bin r /usr/share/locale r /usr/share/doc r /usr/src r /var h /var/lib /var/log /var/www r -CAP_ALL +CAP_DAC_READ_SEARCH bind disabled connect disabled # Role: miro subject /bin/mkdir o / h /Cmn r /Cmn/Kaff rwxcd /Cmn/MyVideos rwxcd

diff -u35 ./grsec_170225_g0n_03 ./grsec_170225_g0n_04

Code: Select all: --- ./grsec_170225_g0n_03 2017-02-25 06:46:48.000000000 +0100 +++ ./grsec_170225_g0n_04 2017-02-25 09:28:04.000000000 +0100 @@ -4654,86 +4654,89 @@ / h -CAP_ALL bind disabled connect disabled # Role: tcpdump subject /usr/sbin/tcpdump o user_transition_allow miro root nobody tcpdump group_transition_allow miro root nobody tcpdump / h /Cmn rwc /etc h /etc/host.conf r /etc/hosts r /etc/ld.so.cache r /etc/resolv.conf r /lib64 h /lib64/libnss_dns-2.23.so rx /lib64/libresolv-2.23.so rx /lib64/libresolv.so.2 rx /proc r /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /usr h /usr/sbin/tcpdump rx -CAP_ALL +CAP_DAC_OVERRIDE bind 0.0.0.0/32:0 dgram ip connect 127.0.0.1/32:53 dgram udp role miro u +user_transition_allow qemu +group_transition_allow kvm libvirt qemu role_allow_ip 0.0.0.0/32 # Role: miro subject / / h /Cmn r /Cmn/Kaff rwxcd /Cmn/MyVideos rwxcd /Cmn/dLo rwxcd /Cmn/gX* rwxcd /Cmn/m* rwxcd /Cmn/src* rwxcd /bin rx /boot h /dev /dev/grsec h /dev/kmem h + /dev/kvm r /dev/log h /dev/mapper h /dev/mapper/Msy /dev/mem h /dev/net r /dev/net/tun rwx /dev/null rw /dev/port h /dev/ptmx rw /dev/pts rw /dev/snd rw /dev/snd rw /dev/sr* rw /dev/tty rw /dev/tty? rw /dev/urandom r /dev/v4l h /dev/v4l/video0 rw /dev/video0 rw /etc r /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/shadow h /etc/shadow- h /etc/ssh h /export h /export/data /export/home /home /home/miro rwxcdl /lib64 rx /lib64/modules h /mnt r /mnt/g* rwxcd @@ -4771,70 +4774,71 @@ /usr/src h /usr/x86_64-pc-linux-gnu x /var /var/cache h /var/cache/fontconfig r /var/lib h /var/lib/lurker rwcdl /var/lib/nfs/rpc_pipefs /var/log h /var/www /var/www/localhost/htdocs rwcdl /var/www/lurker* rwcdl -CAP_ALL bind 0.0.0.0/32:0 ip dgram stream tcp udp connect disabled sock_allow_family unix inet # Role: miro subject /bin/bash o / /Cmn r /Cmn/ls-ABRgo* rwcdl /Cmn/HISTORY* rwxcd /Cmn/Kaff rwxcd /Cmn/MyVideos rwxcd /Cmn/dLo rwxcd /Cmn/gX* rwxcdl /Cmn/m* rwxcdl /Cmn/src* rwxcdl /export rwxcd /bin x /boot h /dev /dev/grsec h /dev/kmem h + /dev/kvm r /dev/log h /dev/mem h /dev/net r /dev/net/tun rwx /dev/null rw /dev/port h /dev/sr0 r /dev/tty rw /etc r /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/shadow h /etc/shadow- h /etc/ssh h /home /home/miro rwxcdl /lib/modules h /lib64 rx /lib64/modules h /mnt r /mnt/g* rwxcd /mnt/H* rwxcd /mnt/sr0 r /mnt/sd?1 rwxcdl /mnt/sr* r /opt /opt/cin x /opt/icedtea-bin-* rx /proc h /proc/meminfo r /sbin h /sbin/conntrack x /sbin/ldconfig x /sbin/macchanger

diff -u35 ./grsec_170225_g0n_04 ./grsec_170225_g0n_05

Code: Select all: --- ./grsec_170225_g0n_04 2017-02-25 09:28:04.000000000 +0100 +++ ./grsec_170225_g0n_05 2017-02-25 11:52:20.000000000 +0100 @@ -7078,71 +7078,71 @@ -CAP_ALL bind 0.0.0.0/32:0 dgram ip # connect 104.237.172.22/32:443 stream dgram tcp udp # connect 192.168.1.1/32:53 dgram udp connect disabled sock_allow_family ipv6 netlink # Role: miro subject /usr/bin/qemu-system-x86_64 ol / h -CAP_ALL bind disabled connect disabled # Role: miro subject /usr/libexec/qemu-bridge-helper o / h /dev h /dev/net/tun rw /etc h /etc/ld.so.cache r /etc/qemu/bridge.conf r /etc/qemu/miro.conf r /lib64 rx /lib64/modules h /proc /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /usr h /usr/lib64/libcap-ng.so.0 rx /usr/lib64/libcap-ng.so.0.0.0 rx - /usr/lib64/libglib-2.0.so.0.4800.2 rx + /usr/lib64/libglib-2.0.so.0.5000.3 rx /usr/libexec/qemu-bridge-helper rx -CAP_ALL +CAP_NET_ADMIN bind disabled connect disabled sock_allow_family unix inet # Role: miro subject /usr/bin/readcd o user_transition_allow miro nobody / h /Cmn h /Cmn/Kaff wc /Cmn/dLo wc /Cmn/MyVideos rwc /Cmn/gX* wc /Cmn/naibdX wc /Cmn/m* wc /dev h /dev/sg0 rw /etc h /etc/default/cdrecord r /etc/ld.so.cache r /lib64 h /lib64/ld-2.*.so x /lib64/libc-2.*.so rx /lib64/libcap.so.2.25 rx /proc /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /usr h

diff -u35 ./grsec_170225_g0n_05 ./grsec_170225_g0n_06

Code: Select all: --- ./grsec_170225_g0n_05 2017-02-25 11:52:20.000000000 +0100 +++ ./grsec_170225_g0n_06 2017-02-25 15:45:40.000000000 +0100 @@ -3201,81 +3201,81 @@ /etc/vim rwcd /home h /home/miro rwcd /lib64 rx /lib64/modules h /mnt r /mnt/sd?1 rwcd /proc h /proc/meminfo r /root rwcdml /sys h /tmp rwcdl /usr /usr/bin x /usr/bin/vim x /usr/lib64 rx /usr/local h /usr/local/bin rwcd /usr/portage rw /usr/share r /usr/src h /var /var/lib/portage /var/lib/portage/world rw /var/log rw -CAP_ALL +CAP_CHOWN +CAP_DAC_OVERRIDE +CAP_DAC_READ_SEARCH +CAP_FOWNER +CAP_FSETID bind disabled connect disabled # Role: root +subject /usr/bin/virsh ol user_transition_allow root qemu group_transition_allow root kvm libvirt qemu -subject /usr/bin/virsh ol / h bind disabled connect disabled # Role: root +subject /usr/bin/virt-install ol user_transition_allow root qemu group_transition_allow root kvm libvirt qemu -subject /usr/bin/virt-install ol / h -CAP_ALL bind disabled connect disabled # Role: root subject /usr/bin/wget o / h /dev h /dev/urandom r /etc r /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/passwd h /etc/shadow h /etc/shadow- h /etc/ssh h /etc/ssl h /etc/ssl/certs/ca-certificates.crt r /lib64 rx /lib64/modules h /mnt h /mnt/sde1/distfiles wc /mnt/sde1/snapshots wc /proc /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /usr h /usr/bin h /usr/bin/wget x @@ -3684,73 +3684,73 @@ /etc/group r /etc/localtime r /etc/passwd r /proc h /proc/sys/kernel/ngroups_max r /root r /tmp rwcd /usr/sbin/crond rx /usr h /usr/sbin/sendmail x /var h /var/spool/cron rwd -CAP_ALL +CAP_CHOWN +CAP_DAC_OVERRIDE +CAP_SETGID +CAP_SETUID +CAP_SYS_ADMIN bind disabled connect disabled sock_allow_family unix inet # Role: root subject /usr/sbin/gpm o / h /dev/input/mice rw /dev h /dev/tty* rw -CAP_ALL +CAP_SYS_ADMIN +CAP_SYS_TTY_CONFIG bind disabled connect disabled # Role: root +subject /usr/sbin/libvirtd ol user_transition_allow root miro qemu group_transition_allow root miro kvm libvirt qemu -subject /usr/sbin/libvirtd ol / h -CAP_ALL bind disabled connect disabled # Role: root subject /usr/sbin/logrotate o user_transition_allow nobody clamav root portage group_transition_allow nobody clamav root portage / h /bin h /bin/bash x /bin/gzip x /etc r /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/shadow h /etc/shadow- h /etc/ssh h /lib64 rx /lib64/modules h /root /usr h /usr/lib64 rx /usr/sbin h /usr/sbin/logrotate rx /var h /var/lib rwcd /var/log rwcd -CAP_ALL +CAP_DAC_READ_SEARCH +CAP_SETGID +CAP_SETUID bind disabled @@ -7051,104 +7051,86 @@ /usr /usr/bin rx /usr/lib64 rx /usr/lib64/gconv h /usr/lib64/gconv/gconv-modules.cache r /usr/lib64/locale h /usr/lib64/locale/locale-archive r /usr/lib64/python3.4 r /usr/lib64/python3.4/collections h /usr/lib64/python3.4/collections/__init__.py /usr/lib64/python3.4/collections/__pycache__/__init__.cpython-34.pyc r /usr/lib64/python3.4/ctypes /usr/lib64/python3.4/ctypes/__pycache__ r /usr/lib64/python3.4/encodings /usr/lib64/python3.4/encodings/__pycache__ r /usr/lib64/python3.4/html /usr/lib64/python3.4/html/__pycache__ r /usr/lib64/python3.4/json /usr/lib64/python3.4/json/__pycache__ r /usr/lib64/python3.4/lib-dynload rx /usr/lib64/python3.4/site-packages r /usr/lib64/python3.4/site-packages/youtube_dl r /usr/lib64/python3.4/site-packages/youtube_dl/__pycache__ rwc /usr/lib64/python3.4/xml r /usr/lib64/python3.4/xml/etree /usr/lib64/python3.4/xml/etree/__pycache__ r /usr/src h -CAP_ALL bind 0.0.0.0/32:0 dgram ip # connect 104.237.172.22/32:443 stream dgram tcp udp # connect 192.168.1.1/32:53 dgram udp connect disabled sock_allow_family ipv6 netlink # Role: miro +user_transition_allow qemu +group_transition_allow kvm libvirt qemu subject /usr/bin/qemu-system-x86_64 ol / h -CAP_ALL bind disabled connect disabled # Role: miro -subject /usr/libexec/qemu-bridge-helper o +user_transition_allow qemu +group_transition_allow kvm libvirt qemu +subject /usr/libexec/qemu-bridge-helper ol / h - /dev h - /dev/net/tun rw - /etc h - /etc/ld.so.cache r - /etc/qemu/bridge.conf r - /etc/qemu/miro.conf r - /lib64 rx - /lib64/modules h - /proc - /proc/bus h - /proc/kallsyms h - /proc/kcore h - /proc/modules h - /proc/slabinfo h - /proc/sys h - /usr h - /usr/lib64/libcap-ng.so.0 rx - /usr/lib64/libcap-ng.so.0.0.0 rx - /usr/lib64/libglib-2.0.so.0.5000.3 rx - /usr/libexec/qemu-bridge-helper rx -CAP_ALL - +CAP_NET_ADMIN bind disabled connect disabled - sock_allow_family unix inet # Role: miro subject /usr/bin/readcd o user_transition_allow miro nobody / h /Cmn h /Cmn/Kaff wc /Cmn/dLo wc /Cmn/MyVideos rwc /Cmn/gX* wc /Cmn/naibdX wc /Cmn/m* wc /dev h /dev/sg0 rw /etc h /etc/default/cdrecord r /etc/ld.so.cache r /lib64 h /lib64/ld-2.*.so x /lib64/libc-2.*.so rx /lib64/libcap.so.2.25 rx /proc /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /usr h /usr/bin h /usr/bin/readcd rx /usr/lib64 rx /usr/share h /usr/share/locale r -CAP_ALL @@ -7661,82 +7643,82 @@ /etc/vim /etc/vim/vimrc r /etc/vim/vimrc.local r /home h /home/miro rwcd /lib64 rx /lib64/modules h /mnt r /mnt/sd?1 rwcd /mnt/g* rwxcd /mnt/H* rwxcd /proc h /proc/meminfo r /sys h /tmp rwcd /usr /usr/bin x /usr/lib64 rx /usr/local h /usr/local/bin rw /usr/share rwc /usr/share/locale r /usr/src h /var h /var/lib /var/lib/lurker rwcdl /var/tmp rwcd /var/www /var/www/localhost/htdocs rwcdl /var/www/lurker* rwcd -CAP_ALL bind disabled connect disabled # Role: miro +subject /usr/bin/virsh ol user_transition_allow root qemu group_transition_allow root kvm libvirt qemu -subject /usr/bin/virsh ol / h -CAP_ALL bind disabled connect disabled # Role: miro +subject /usr/bin/virt-install ol user_transition_allow root qemu group_transition_allow root kvm libvirt qemu -subject /usr/bin/virt-install ol / h -CAP_ALL bind disabled connect disabled # Role: miro subject /usr/bin/wget o / h /Cmn rwc /Cmn/dLo rwcdl /dev h /dev/urandom r /etc r /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/passwd h /etc/shadow h /etc/shadow- h /etc/ssh h /etc/ssl h /etc/ssl/certs/ca-certificates.crt r /home /home/miro rwc /lib64 rx /lib64/modules h /mnt wc /proc /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /tmp rwcd @@ -8619,73 +8601,73 @@ /usr/share/locale r -CAP_ALL bind disabled connect disabled sock_allow_family unix inet subject /usr/local/bin/tzap-cat-g0.sh o / h /Cmn h /Cmn/Kaff wc /bin x /dev h /dev/null r /dev/tty rw /etc h /etc/ld.so.cache r /lib64 rx /lib64/modules h /usr h /usr/bin h /usr/bin/gawk x /usr/bin/tzap x /usr/lib64 h /usr/lib64/gconv/gconv-modules.cache r /usr/lib64/locale/locale-archive r /usr/local h /usr/local/bin/tzap-cat.sh rx /usr/share h /usr/share/locale r -CAP_ALL bind disabled connect disabled sock_allow_family unix inet # Role: miro +subject /usr/sbin/libvirtd ol user_transition_allow root miro qemu group_transition_allow root miro kvm libvirt qemu -subject /usr/sbin/libvirtd ol / h -CAP_ALL bind disabled connect disabled # Role: miro subject /usr/sbin/postdrop o / h /dev h /dev/log rw /etc r /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/postfix h /etc/postfix/main.cf r /etc/shadow h /etc/shadow- h /etc/ssh h /lib64 rx /lib64/modules h /usr h /usr/lib64 rx /usr/sbin h /usr/sbin/postdrop x /usr/share h /usr/share/zoneinfo r /var h /var/spool/postfix rwcd -CAP_ALL +CAP_SETGID +CAP_SETUID bind 0.0.0.0/32:0 stream tcp udp connect 127.0.0.1/32 ip dgram stream tcp udp sock_allow_family all

diff -u35 ./grsec_170225_g0n_06 ./grsec_170226_g0n_00

Code: Select all: --- ./grsec_170225_g0n_06 2017-02-25 15:45:40.000000000 +0100 +++ ./grsec_170226_g0n_00 2017-02-26 19:54:17.760684150 +0100 @@ -7051,82 +7051,82 @@ /usr /usr/bin rx /usr/lib64 rx /usr/lib64/gconv h /usr/lib64/gconv/gconv-modules.cache r /usr/lib64/locale h /usr/lib64/locale/locale-archive r /usr/lib64/python3.4 r /usr/lib64/python3.4/collections h /usr/lib64/python3.4/collections/__init__.py /usr/lib64/python3.4/collections/__pycache__/__init__.cpython-34.pyc r /usr/lib64/python3.4/ctypes /usr/lib64/python3.4/ctypes/__pycache__ r /usr/lib64/python3.4/encodings /usr/lib64/python3.4/encodings/__pycache__ r /usr/lib64/python3.4/html /usr/lib64/python3.4/html/__pycache__ r /usr/lib64/python3.4/json /usr/lib64/python3.4/json/__pycache__ r /usr/lib64/python3.4/lib-dynload rx /usr/lib64/python3.4/site-packages r /usr/lib64/python3.4/site-packages/youtube_dl r /usr/lib64/python3.4/site-packages/youtube_dl/__pycache__ rwc /usr/lib64/python3.4/xml r /usr/lib64/python3.4/xml/etree /usr/lib64/python3.4/xml/etree/__pycache__ r /usr/src h -CAP_ALL bind 0.0.0.0/32:0 dgram ip # connect 104.237.172.22/32:443 stream dgram tcp udp # connect 192.168.1.1/32:53 dgram udp connect disabled sock_allow_family ipv6 netlink # Role: miro +subject /usr/bin/qemu-system-x86_64 ol user_transition_allow qemu group_transition_allow kvm libvirt qemu -subject /usr/bin/qemu-system-x86_64 ol / h -CAP_ALL bind disabled connect disabled # Role: miro +subject /usr/libexec/qemu-bridge-helper ol user_transition_allow qemu group_transition_allow kvm libvirt qemu -subject /usr/libexec/qemu-bridge-helper ol / h -CAP_ALL bind disabled connect disabled # Role: miro subject /usr/bin/readcd o user_transition_allow miro nobody / h /Cmn h /Cmn/Kaff wc /Cmn/dLo wc /Cmn/MyVideos rwc /Cmn/gX* wc /Cmn/naibdX wc /Cmn/m* wc /dev h /dev/sg0 rw /etc h /etc/default/cdrecord r /etc/ld.so.cache r /lib64 h /lib64/ld-2.*.so x /lib64/libc-2.*.so rx /lib64/libcap.so.2.25 rx /proc /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /usr h /usr/bin h /usr/bin/readcd rx

That is what worked on the VMs started with qemu (but, if you peruse those, still all in learning mode):
https://www.croatiafidelis.hr/foss/cap/ ... vuan-9.php

by **timbgo** » Sun Feb 26, 2017 4:20 pm

And, having found the method, I think I should repost, and link to here, what I posted in the first post of this topic, since this will be much more readable.

The command is:

Code: Select all: # > j_TMP ; j=$(cat j_TMP); for i in $(ls -1 /mnt/H0214_g0n-r/root/ | grep grsec_170|grep -Ev 'grsec_1702\.d|\.tar|HERE' ); do if [ -e "j_TMP" ]; then echo cat j_TMP; cat j_TMP; j=$(cat j_TMP); echo $j; read FAKE ; echo diff /mnt/H0214_g0n-r/root/$j /mnt/H0214_g0n-r/root/$i ; if [ ! -d "/mnt/H0214_g0n-r/root/${j}" ]; then echo diff /mnt/H0214_g0n-r/root/$j /mnt/H0214_g0n-r/root/$i ; echo |& tee -a /Cmn/m/B/Virt_170226/grsec_list_CMD.txt; echo "[b]diff -u35 /mnt/H0214_g0n-r/root/$j /mnt/H0214_g0n-r/root/$i[/b]" |& tee -a /Cmn/m/B/Virt_170226/grsec_list_CMD.txt ; echo |& tee -a /Cmn/m/B/Virt_170226/grsec_list_CMD.txt ; echo "[code]" |& tee -a /Cmn/m/B/Virt_170226/grsec_list_CMD.txt ; read FAKE; diff -u35 /mnt/H0214_g0n-r/root/$j /mnt/H0214_g0n-r/root/$i |& tee -a /Cmn/m/B/Virt_170226/grsec_list_CMD.txt ; echo "[/code]" |& tee -a /Cmn/m/B/Virt_170226/grsec_list_CMD.txt ; fi; fi; echo $i > j_TMP; cat j_TMP; read FAKE; done ;

And before I paste the diffs stowed in one file, but which will show as separate diffs in this one post, let me tell that I didn't manually check them in detail. I checked that they contain the diffs btwn same files, and that's it. If any details are now unclear, kind reader, do tell!

So this are the diffs:

diff -u35 /mnt/H0214_g0n-r/root/grsec_170211_g0n_01 /mnt/H0214_g0n-r/root/grsec_170211_g0n_02

Code: Select all: --- /mnt/H0214_g0n-r/root/grsec_170211_g0n_01 2017-02-11 12:15:13.245601630 +0100 +++ /mnt/H0214_g0n-r/root/grsec_170211_g0n_02 2017-02-11 12:20:29.643602579 +0100 @@ -3183,70 +3183,71 @@ /usr/bin/vim x /usr/lib64 rx /usr/local h /usr/local/bin rwcd /usr/portage rw /usr/share r /usr/src h /var /var/lib/portage /var/lib/portage/world rw /var/log rw -CAP_ALL +CAP_CHOWN +CAP_DAC_OVERRIDE +CAP_DAC_READ_SEARCH +CAP_FOWNER +CAP_FSETID bind disabled connect disabled # Role: root subject /usr/bin/virsh o / h /dev h /dev/urandom r /etc r /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/libvirt r /etc/shadow h /etc/shadow- h /etc/ssh h /etc/ssl h /etc/ssl/openssl.cnf r + /home/miro r /lib64 rx /lib64/modules h /proc r /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /root rwcd /run h /run/libvirt rw /usr h /usr/bin h /usr/bin/virsh rx /usr/lib64 rx /usr/share h /usr/share/locale r /usr/share/terminfo r -CAP_ALL +CAP_DAC_OVERRIDE bind disabled connect disabled sock_allow_family unix inet ipv6 # Role: root subject /usr/bin/wget o / h /dev h /dev/urandom r /etc r /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/passwd h

diff -u35 /mnt/H0214_g0n-r/root/grsec_170211_g0n_02 /mnt/H0214_g0n-r/root/grsec_170211_g0n_03

Code: Select all: --- /mnt/H0214_g0n-r/root/grsec_170211_g0n_02 2017-02-11 12:20:29.643602579 +0100 +++ /mnt/H0214_g0n-r/root/grsec_170211_g0n_03 2017-02-11 12:39:48.523606053 +0100 @@ -3681,88 +3681,92 @@ /root r /tmp rwcd /usr/sbin/crond rx /usr h /usr/sbin/sendmail x /var h /var/spool/cron rwd -CAP_ALL +CAP_CHOWN +CAP_DAC_OVERRIDE +CAP_SETGID +CAP_SETUID +CAP_SYS_ADMIN bind disabled connect disabled sock_allow_family unix inet # Role: root subject /usr/sbin/gpm o / h /dev/input/mice rw /dev h /dev/tty* rw -CAP_ALL +CAP_SYS_ADMIN +CAP_SYS_TTY_CONFIG bind disabled connect disabled # Role: root subject /usr/sbin/libvirtd o / h /dev h /dev/net/tun rw /dev/null rw + /dev/urandom r /etc h /etc/group r /etc/libvirt r /etc/passwd r /proc r /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /run h /run/libvirt wd /sbin h /sbin/xtables-multi x /sys h /sys/devices/system/cpu/online r /usr h + /usr/bin + /usr/bin/qemu-system-x86_64 x + /usr/sbin /usr/sbin/libvirtd rx -CAP_ALL +CAP_DAC_READ_SEARCH +CAP_KILL +CAP_NET_ADMIN +CAP_NET_RAW bind disabled connect disabled sock_allow_family unix inet netlink packet # Role: root subject /usr/sbin/logrotate o user_transition_allow nobody clamav root portage group_transition_allow nobody clamav root portage / h /bin h /bin/bash x /bin/gzip x /etc r /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/shadow h /etc/shadow- h /etc/ssh h /lib64 rx /lib64/modules h /root /usr h /usr/lib64 rx /usr/sbin h /usr/sbin/logrotate rx /var h /var/lib rwcd /var/log rwcd

diff -u35 /mnt/H0214_g0n-r/root/grsec_170211_g0n_03 /mnt/H0214_g0n-r/root/grsec_170211_g0n_04

Code: Select all: --- /mnt/H0214_g0n-r/root/grsec_170211_g0n_03 2017-02-11 12:39:48.523606053 +0100 +++ /mnt/H0214_g0n-r/root/grsec_170211_g0n_04 2017-02-11 12:54:21.220608669 +0100 @@ -3704,70 +3704,71 @@ -CAP_ALL +CAP_SYS_ADMIN +CAP_SYS_TTY_CONFIG bind disabled connect disabled # Role: root subject /usr/sbin/libvirtd o / h /dev h /dev/net/tun rw /dev/null rw /dev/urandom r /etc h /etc/group r /etc/libvirt r /etc/passwd r /proc r /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /run h /run/libvirt wd /sbin h /sbin/xtables-multi x /sys h /sys/devices/system/cpu/online r /usr h /usr/bin /usr/bin/qemu-system-x86_64 x /usr/sbin /usr/sbin/libvirtd rx + /var/cache/libvirt rwcd -CAP_ALL +CAP_DAC_READ_SEARCH +CAP_KILL +CAP_NET_ADMIN +CAP_NET_RAW bind disabled connect disabled sock_allow_family unix inet netlink packet # Role: root subject /usr/sbin/logrotate o user_transition_allow nobody clamav root portage group_transition_allow nobody clamav root portage / h /bin h /bin/bash x /bin/gzip x /etc r /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/shadow h /etc/shadow- h /etc/ssh h /lib64 rx /lib64/modules h /root /usr h /usr/lib64 rx /usr/sbin h /usr/sbin/logrotate rx /var h /var/lib rwcd /var/log rwcd -CAP_ALL

diff -u35 /mnt/H0214_g0n-r/root/grsec_170211_g0n_04 /mnt/H0214_g0n-r/root/grsec_170211_g0n_05-l

Code: Select all: --- /mnt/H0214_g0n-r/root/grsec_170211_g0n_04 2017-02-11 12:54:21.220608669 +0100 +++ /mnt/H0214_g0n-r/root/grsec_170211_g0n_05-l 2017-02-11 14:11:20.533622517 +0100 @@ -3676,70 +3676,72 @@ /etc/group r /etc/localtime r /etc/passwd r /proc h /proc/sys/kernel/ngroups_max r /root r /tmp rwcd /usr/sbin/crond rx /usr h /usr/sbin/sendmail x /var h /var/spool/cron rwd -CAP_ALL +CAP_CHOWN +CAP_DAC_OVERRIDE +CAP_SETGID +CAP_SETUID +CAP_SYS_ADMIN bind disabled connect disabled sock_allow_family unix inet # Role: root subject /usr/sbin/gpm o / h /dev/input/mice rw /dev h /dev/tty* rw -CAP_ALL +CAP_SYS_ADMIN +CAP_SYS_TTY_CONFIG bind disabled connect disabled # Role: root +user_transition_allow root qemu +group_transition_allow root kvm libvirt qemu subject /usr/sbin/libvirtd o / h /dev h /dev/net/tun rw /dev/null rw /dev/urandom r /etc h /etc/group r /etc/libvirt r /etc/passwd r /proc r /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /run h /run/libvirt wd /sbin h /sbin/xtables-multi x /sys h /sys/devices/system/cpu/online r /usr h /usr/bin /usr/bin/qemu-system-x86_64 x /usr/sbin /usr/sbin/libvirtd rx /var/cache/libvirt rwcd -CAP_ALL +CAP_DAC_READ_SEARCH +CAP_KILL +CAP_NET_ADMIN +CAP_NET_RAW bind disabled @@ -4518,70 +4520,74 @@ /etc/gai.conf r /etc/hosts r /etc/localtime r /etc/resolv.conf r /run h /run/clamav/clamd.sock rw /var h /var/lib/clamav rwcd /var/log/clamav rwc -CAP_ALL bind 0.0.0.0/32:0 dgram ip connect 0.0.0.0/0:53 dgram udp connect 127.0.0.1/32:53 dgram udp connect 193.92.150.194/32:80 stream dgram tcp udp connect 195.222.33.229/32:80 stream dgram tcp udp connect 192.168.1.1/32:53 dgram udp sock_allow_family netlink # Role: clamav subject /usr/sbin/clamd o / h /proc r /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /var/lib/clamav r /var/log/clamav /var/log/clamav/clamd.log a -CAP_ALL bind disabled connect disabled +role kvm gl + +role libvirt gl + role mysql u #role_allow_ip 0.0.0.0/32 user_transition_allow root group_transition_allow root # Role: mysql subject / / h -CAP_ALL bind disabled connect disabled # Role: mysql subject /usr/sbin/mysqld o user_transition_allow root mysql nobody group_transition_allow root mysql nobody / h /sys/devices/system/cpu/online r /tmp rwcd /usr/sbin/mysqld rx /var/lib/mysql rwcd # /var/lib/mysql/performance_schema # /var/lib/mysql/performance_schema/db.opt r -CAP_ALL bind 127.0.0.1/32:3306 stream tcp connect disabled role postfix u role_allow_ip 0.0.0.0/32 user_transition_allow root group_transition_allow root # Role: postfix subject / / h /dev/urandom r /etc/localtime @@ -4618,70 +4624,74 @@ /proc h /proc/sys/kernel/ngroups_max r /root /root/Maildir rwcdl /sys h /sys/devices/system/cpu/online r /usr h /usr/lib64 rx /usr/libexec x /var h /var/lib/postfix rwcd /var/spool/postfix rwcdl /var/tmp -CAP_ALL +CAP_DAC_READ_SEARCH +CAP_KILL +CAP_SETGID +CAP_SETUID bind 0.0.0.0/32:0 ip dgram stream tcp udp connect 127.0.0.1/32 ip dgram stream tcp udp connect 192.168.1.1/32:53 dgram udp connect 195.29.150.0/24 ip dgram stream tcp udp connect 178.218.165.68/32 ip dgram stream tcp udp sock_allow_family all # Role: postfix subject /usr/sbin/postsuper o user_transition_allow root group_transition_allow root / h /var/spool/postfix wd -CAP_ALL bind disabled connect disabled +role qemu ul +user_transition_allow root qemu +group_transition_allow root kvm libvirt qemu + role tcpdump u subject / o / h -CAP_ALL bind disabled connect disabled # Role: tcpdump subject /usr/sbin/tcpdump o user_transition_allow miro root nobody tcpdump group_transition_allow miro root nobody tcpdump / h /Cmn rwc /etc h /etc/host.conf r /etc/hosts r /etc/ld.so.cache r /etc/resolv.conf r /lib64 h /lib64/libnss_dns-2.23.so rx /lib64/libresolv-2.23.so rx /lib64/libresolv.so.2 rx /proc r /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /usr h /usr/sbin/tcpdump rx -CAP_ALL +CAP_DAC_OVERRIDE bind 0.0.0.0/32:0 dgram ip connect 127.0.0.1/32:53 dgram udp

diff -u35 /mnt/H0214_g0n-r/root/grsec_170211_g0n_05-l /mnt/H0214_g0n-r/root/grsec_170211_g0n_06-l

Code: Select all: --- /mnt/H0214_g0n-r/root/grsec_170211_g0n_05-l 2017-02-11 14:11:20.533622517 +0100 +++ /mnt/H0214_g0n-r/root/grsec_170211_g0n_06-l 2017-02-11 14:15:30.337623266 +0100 @@ -4521,72 +4521,76 @@ /etc/hosts r /etc/localtime r /etc/resolv.conf r /run h /run/clamav/clamd.sock rw /var h /var/lib/clamav rwcd /var/log/clamav rwc -CAP_ALL bind 0.0.0.0/32:0 dgram ip connect 0.0.0.0/0:53 dgram udp connect 127.0.0.1/32:53 dgram udp connect 193.92.150.194/32:80 stream dgram tcp udp connect 195.222.33.229/32:80 stream dgram tcp udp connect 192.168.1.1/32:53 dgram udp sock_allow_family netlink # Role: clamav subject /usr/sbin/clamd o / h /proc r /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /var/lib/clamav r /var/log/clamav /var/log/clamav/clamd.log a -CAP_ALL bind disabled connect disabled role kvm gl +user_transition_allow root qemu +group_transition_allow root kvm libvirt qemu role libvirt gl +user_transition_allow root qemu +group_transition_allow root kvm libvirt qemu role mysql u #role_allow_ip 0.0.0.0/32 user_transition_allow root group_transition_allow root # Role: mysql subject / / h -CAP_ALL bind disabled connect disabled # Role: mysql subject /usr/sbin/mysqld o user_transition_allow root mysql nobody group_transition_allow root mysql nobody / h /sys/devices/system/cpu/online r /tmp rwcd /usr/sbin/mysqld rx /var/lib/mysql rwcd # /var/lib/mysql/performance_schema # /var/lib/mysql/performance_schema/db.opt r -CAP_ALL bind 127.0.0.1/32:3306 stream tcp connect disabled role postfix u role_allow_ip 0.0.0.0/32 user_transition_allow root group_transition_allow root # Role: postfix subject / / h /dev/urandom r

diff -u35 /mnt/H0214_g0n-r/root/grsec_170211_g0n_06-l /mnt/H0214_g0n-r/root/grsec_170211_g0n_07-l

Code: Select all: --- /mnt/H0214_g0n-r/root/grsec_170211_g0n_06-l 2017-02-11 14:15:30.337623266 +0100 +++ /mnt/H0214_g0n-r/root/grsec_170211_g0n_07-l 2017-02-11 15:35:09.099637592 +0100 @@ -578,72 +578,72 @@ /usr/lib64/locale/locale-archive r /usr/portage wd -CAP_ALL bind disabled connect disabled # Role: portage subject /usr/bin/wget o / h /dev h /dev/urandom r /etc h /etc/ld.so.cache r /etc/localtime r /etc/wgetrc r /lib64 rx /lib64/modules h /usr h /usr/bin h /usr/bin/wget x /usr/lib64 rx /usr/portage wc /var h /var/log/portage_logs /var/log/portage_logs/wget-fetch.log a -CAP_ALL bind disabled connect 192.168.2.0/24:80 stream tcp connect 192.168.3.0/24:80 stream tcp role root uG role_transitions admin shutdown role_allow_ip 192.168.2.0/24 role_allow_ip 192.168.3.0/24 role_allow_ip 0.0.0.0/32 -user_transition_allow apache miro tcpdump -group_transition_allow apache miro tcpdump +user_transition_allow apache miro tcpdump qemu +group_transition_allow apache miro tcpdump kvm libvirt qemu # Role: root subject / / h /Cmn r /Cmn/Kaff rwxcd /Cmn/MyVideos rwxcd /Cmn/dLo rwxcd /Cmn/gX* rwxcd /Cmn/m* rwxcd /bin rx /sbin rx /dev /dev/grsec h /dev/kmem h /dev/log h /dev/mem h /dev/null rw /dev/port h /dev/tty rw /dev/urandom r /etc rx /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/shadow h /etc/shadow- h /etc/ssh h /export h /export/data /export/home /home h /home/miro rx /lib64 rx /lib64/firmware h /lib64/firmware/radeon

diff -u35 /mnt/H0214_g0n-r/root/grsec_170211_g0n_07-l /mnt/H0214_g0n-r/root/grsec_170211_g0n_08-l

Code: Select all: --- /mnt/H0214_g0n-r/root/grsec_170211_g0n_07-l 2017-02-11 15:35:09.099637592 +0100 +++ /mnt/H0214_g0n-r/root/grsec_170211_g0n_08-l 2017-02-11 15:43:59.647639183 +0100 @@ -3712,70 +3712,72 @@ group_transition_allow root kvm libvirt qemu subject /usr/sbin/libvirtd o / h /dev h /dev/net/tun rw /dev/null rw /dev/urandom r /etc h /etc/group r /etc/libvirt r /etc/passwd r /proc r /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /run h /run/libvirt wd /sbin h /sbin/xtables-multi x /sys h /sys/devices/system/cpu/online r /usr h /usr/bin /usr/bin/qemu-system-x86_64 x /usr/sbin /usr/sbin/libvirtd rx /var/cache/libvirt rwcd -CAP_ALL +CAP_DAC_READ_SEARCH +CAP_KILL +CAP_NET_ADMIN +CAP_NET_RAW + +CAP_SETGID + +CAP_DAC_OVERRIDE bind disabled connect disabled sock_allow_family unix inet netlink packet # Role: root subject /usr/sbin/logrotate o user_transition_allow nobody clamav root portage group_transition_allow nobody clamav root portage / h /bin h /bin/bash x /bin/gzip x /etc r /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/shadow h /etc/shadow- h /etc/ssh h /lib64 rx /lib64/modules h /root /usr h /usr/lib64 rx /usr/sbin h /usr/sbin/logrotate rx /var h /var/lib rwcd /var/log rwcd -CAP_ALL +CAP_DAC_READ_SEARCH +CAP_SETGID +CAP_SETUID bind disabled connect disabled

diff -u35 /mnt/H0214_g0n-r/root/grsec_170211_g0n_08-l /mnt/H0214_g0n-r/root/grsec_170211_g0n_09-l

Code: Select all: --- /mnt/H0214_g0n-r/root/grsec_170211_g0n_08-l 2017-02-11 15:43:59.647639183 +0100 +++ /mnt/H0214_g0n-r/root/grsec_170211_g0n_09-l 2017-02-11 15:50:22.619640331 +0100 @@ -3712,70 +3712,71 @@ group_transition_allow root kvm libvirt qemu subject /usr/sbin/libvirtd o / h /dev h /dev/net/tun rw /dev/null rw /dev/urandom r /etc h /etc/group r /etc/libvirt r /etc/passwd r /proc r /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /run h /run/libvirt wd /sbin h /sbin/xtables-multi x /sys h /sys/devices/system/cpu/online r /usr h /usr/bin /usr/bin/qemu-system-x86_64 x /usr/sbin /usr/sbin/libvirtd rx /var/cache/libvirt rwcd -CAP_ALL +CAP_DAC_READ_SEARCH +CAP_KILL +CAP_NET_ADMIN +CAP_NET_RAW + +CAP_SETUID +CAP_SETGID +CAP_DAC_OVERRIDE bind disabled connect disabled sock_allow_family unix inet netlink packet # Role: root subject /usr/sbin/logrotate o user_transition_allow nobody clamav root portage group_transition_allow nobody clamav root portage / h /bin h /bin/bash x /bin/gzip x /etc r /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/shadow h /etc/shadow- h /etc/ssh h /lib64 rx /lib64/modules h /root /usr h /usr/lib64 rx /usr/sbin h /usr/sbin/logrotate rx /var h /var/lib rwcd /var/log rwcd -CAP_ALL +CAP_DAC_READ_SEARCH +CAP_SETGID +CAP_SETUID

diff -u35 /mnt/H0214_g0n-r/root/grsec_170211_g0n_09-l /mnt/H0214_g0n-r/root/grsec_170211_g0n_10-l

Code: Select all: --- /mnt/H0214_g0n-r/root/grsec_170211_g0n_09-l 2017-02-11 15:50:22.619640331 +0100 +++ /mnt/H0214_g0n-r/root/grsec_170211_g0n_10-l 2017-02-11 16:15:47.772644903 +0100 @@ -3695,70 +3695,72 @@ connect disabled sock_allow_family unix inet # Role: root subject /usr/sbin/gpm o / h /dev/input/mice rw /dev h /dev/tty* rw -CAP_ALL +CAP_SYS_ADMIN +CAP_SYS_TTY_CONFIG bind disabled connect disabled # Role: root user_transition_allow root qemu group_transition_allow root kvm libvirt qemu subject /usr/sbin/libvirtd o / h /dev h /dev/net/tun rw /dev/null rw /dev/urandom r /etc h /etc/group r /etc/libvirt r /etc/passwd r /proc r /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h + /proc/sys/kernel r +# /proc/sys/kernel/cap_last_cap r /run h /run/libvirt wd /sbin h /sbin/xtables-multi x /sys h /sys/devices/system/cpu/online r /usr h /usr/bin /usr/bin/qemu-system-x86_64 x /usr/sbin /usr/sbin/libvirtd rx /var/cache/libvirt rwcd -CAP_ALL +CAP_DAC_READ_SEARCH +CAP_KILL +CAP_NET_ADMIN +CAP_NET_RAW +CAP_SETUID +CAP_SETGID +CAP_DAC_OVERRIDE bind disabled connect disabled sock_allow_family unix inet netlink packet # Role: root subject /usr/sbin/logrotate o user_transition_allow nobody clamav root portage group_transition_allow nobody clamav root portage / h /bin h /bin/bash x /bin/gzip x /etc r /etc/grsec h /etc/gshadow h

diff -u35 /mnt/H0214_g0n-r/root/grsec_170211_g0n_10-l /mnt/H0214_g0n-r/root/grsec_170211_g0n_11-l

Code: Select all: --- /mnt/H0214_g0n-r/root/grsec_170211_g0n_10-l 2017-02-11 16:15:47.772644903 +0100 +++ /mnt/H0214_g0n-r/root/grsec_170211_g0n_11-l 2017-02-11 16:37:39.156648834 +0100 @@ -3686,71 +3686,71 @@ /var h /var/spool/cron rwd -CAP_ALL +CAP_CHOWN +CAP_DAC_OVERRIDE +CAP_SETGID +CAP_SETUID +CAP_SYS_ADMIN bind disabled connect disabled sock_allow_family unix inet # Role: root subject /usr/sbin/gpm o / h /dev/input/mice rw /dev h /dev/tty* rw -CAP_ALL +CAP_SYS_ADMIN +CAP_SYS_TTY_CONFIG bind disabled connect disabled # Role: root user_transition_allow root qemu group_transition_allow root kvm libvirt qemu subject /usr/sbin/libvirtd o / h /dev h /dev/net/tun rw /dev/null rw /dev/urandom r /etc h /etc/group r - /etc/libvirt r + /etc/libvirt rwcdl /etc/passwd r /proc r /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /proc/sys/kernel r # /proc/sys/kernel/cap_last_cap r /run h /run/libvirt wd /sbin h /sbin/xtables-multi x /sys h /sys/devices/system/cpu/online r /usr h /usr/bin /usr/bin/qemu-system-x86_64 x /usr/sbin /usr/sbin/libvirtd rx /var/cache/libvirt rwcd -CAP_ALL +CAP_DAC_READ_SEARCH +CAP_KILL +CAP_NET_ADMIN +CAP_NET_RAW +CAP_SETUID +CAP_SETGID +CAP_DAC_OVERRIDE bind disabled connect disabled sock_allow_family unix inet netlink packet # Role: root

diff -u35 /mnt/H0214_g0n-r/root/grsec_170211_g0n_11-l /mnt/H0214_g0n-r/root/grsec_170211_g0n_12-l

Code: Select all: --- /mnt/H0214_g0n-r/root/grsec_170211_g0n_11-l 2017-02-11 16:37:39.156648834 +0100 +++ /mnt/H0214_g0n-r/root/grsec_170211_g0n_12-l 2017-02-11 18:19:35.056667169 +0100 @@ -3699,74 +3699,76 @@ subject /usr/sbin/gpm o / h /dev/input/mice rw /dev h /dev/tty* rw -CAP_ALL +CAP_SYS_ADMIN +CAP_SYS_TTY_CONFIG bind disabled connect disabled # Role: root user_transition_allow root qemu group_transition_allow root kvm libvirt qemu subject /usr/sbin/libvirtd o / h /dev h /dev/net/tun rw /dev/null rw /dev/urandom r /etc h /etc/group r /etc/libvirt rwcdl /etc/passwd r /proc r /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /proc/sys/kernel r # /proc/sys/kernel/cap_last_cap r /run h /run/libvirt wd + /run/xtables.lock wcd /sbin h /sbin/xtables-multi x /sys h /sys/devices/system/cpu/online r + /sys/devices/virtual/net/virbr1 r /usr h /usr/bin /usr/bin/qemu-system-x86_64 x /usr/sbin /usr/sbin/libvirtd rx /var/cache/libvirt rwcd -CAP_ALL +CAP_DAC_READ_SEARCH +CAP_KILL +CAP_NET_ADMIN +CAP_NET_RAW +CAP_SETUID +CAP_SETGID +CAP_DAC_OVERRIDE bind disabled connect disabled sock_allow_family unix inet netlink packet # Role: root subject /usr/sbin/logrotate o user_transition_allow nobody clamav root portage group_transition_allow nobody clamav root portage / h /bin h /bin/bash x /bin/gzip x /etc r /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/shadow h /etc/shadow- h /etc/ssh h /lib64 rx /lib64/modules h

diff -u35 /mnt/H0214_g0n-r/root/grsec_170211_g0n_12-l /mnt/H0214_g0n-r/root/grsec_170211_g0n_13-l

Code: Select all: --- /mnt/H0214_g0n-r/root/grsec_170211_g0n_12-l 2017-02-11 18:19:35.056667169 +0100 +++ /mnt/H0214_g0n-r/root/grsec_170211_g0n_13-l 2017-02-11 19:02:20.433674860 +0100 @@ -3681,70 +3681,71 @@ /root r /tmp rwcd /usr/sbin/crond rx /usr h /usr/sbin/sendmail x /var h /var/spool/cron rwd -CAP_ALL +CAP_CHOWN +CAP_DAC_OVERRIDE +CAP_SETGID +CAP_SETUID +CAP_SYS_ADMIN bind disabled connect disabled sock_allow_family unix inet # Role: root subject /usr/sbin/gpm o / h /dev/input/mice rw /dev h /dev/tty* rw -CAP_ALL +CAP_SYS_ADMIN +CAP_SYS_TTY_CONFIG bind disabled connect disabled # Role: root user_transition_allow root qemu group_transition_allow root kvm libvirt qemu subject /usr/sbin/libvirtd o / h /dev h + /dev/kvm rw /dev/net/tun rw /dev/null rw /dev/urandom r /etc h /etc/group r /etc/libvirt rwcdl /etc/passwd r /proc r /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /proc/sys/kernel r # /proc/sys/kernel/cap_last_cap r /run h /run/libvirt wd /run/xtables.lock wcd /sbin h /sbin/xtables-multi x /sys h /sys/devices/system/cpu/online r /sys/devices/virtual/net/virbr1 r /usr h /usr/bin /usr/bin/qemu-system-x86_64 x /usr/sbin /usr/sbin/libvirtd rx /var/cache/libvirt rwcd -CAP_ALL +CAP_DAC_READ_SEARCH +CAP_KILL +CAP_NET_ADMIN +CAP_NET_RAW

diff -u35 /mnt/H0214_g0n-r/root/grsec_170211_g0n_13-l /mnt/H0214_g0n-r/root/grsec_170211_g0n_14-l

Code: Select all: --- /mnt/H0214_g0n-r/root/grsec_170211_g0n_13-l 2017-02-11 19:02:20.433674860 +0100 +++ /mnt/H0214_g0n-r/root/grsec_170211_g0n_14-l 2017-02-11 19:22:36.411678505 +0100 @@ -3722,71 +3722,71 @@ /etc/libvirt rwcdl /etc/passwd r /proc r /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /proc/sys/kernel r # /proc/sys/kernel/cap_last_cap r /run h /run/libvirt wd /run/xtables.lock wcd /sbin h /sbin/xtables-multi x /sys h /sys/devices/system/cpu/online r /sys/devices/virtual/net/virbr1 r /usr h /usr/bin /usr/bin/qemu-system-x86_64 x /usr/sbin /usr/sbin/libvirtd rx /var/cache/libvirt rwcd -CAP_ALL +CAP_DAC_READ_SEARCH +CAP_KILL +CAP_NET_ADMIN +CAP_NET_RAW +CAP_SETUID +CAP_SETGID +CAP_DAC_OVERRIDE bind disabled connect disabled - sock_allow_family unix inet netlink packet + sock_allow_family unix inet ipv6 netlink packet # Role: root subject /usr/sbin/logrotate o user_transition_allow nobody clamav root portage group_transition_allow nobody clamav root portage / h /bin h /bin/bash x /bin/gzip x /etc r /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/shadow h /etc/shadow- h /etc/ssh h /lib64 rx /lib64/modules h /root /usr h /usr/lib64 rx /usr/sbin h /usr/sbin/logrotate rx /var h /var/lib rwcd /var/log rwcd -CAP_ALL +CAP_DAC_READ_SEARCH +CAP_SETGID +CAP_SETUID bind disabled connect disabled sock_allow_family unix inet ## Role: root

diff -u35 /mnt/H0214_g0n-r/root/grsec_170211_g0n_14-l /mnt/H0214_g0n-r/root/grsec_170211_g0n_15-l

Code: Select all: --- /mnt/H0214_g0n-r/root/grsec_170211_g0n_14-l 2017-02-11 19:22:36.411678505 +0100 +++ /mnt/H0214_g0n-r/root/grsec_170211_g0n_15-l 2017-02-11 19:40:40.707681756 +0100 @@ -3722,71 +3722,71 @@ /etc/libvirt rwcdl /etc/passwd r /proc r /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /proc/sys/kernel r # /proc/sys/kernel/cap_last_cap r /run h /run/libvirt wd /run/xtables.lock wcd /sbin h /sbin/xtables-multi x /sys h /sys/devices/system/cpu/online r /sys/devices/virtual/net/virbr1 r /usr h /usr/bin /usr/bin/qemu-system-x86_64 x /usr/sbin /usr/sbin/libvirtd rx /var/cache/libvirt rwcd -CAP_ALL +CAP_DAC_READ_SEARCH +CAP_KILL +CAP_NET_ADMIN +CAP_NET_RAW +CAP_SETUID +CAP_SETGID +CAP_DAC_OVERRIDE bind disabled connect disabled - sock_allow_family unix inet ipv6 netlink packet + sock_allow_family all # Role: root subject /usr/sbin/logrotate o user_transition_allow nobody clamav root portage group_transition_allow nobody clamav root portage / h /bin h /bin/bash x /bin/gzip x /etc r /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/shadow h /etc/shadow- h /etc/ssh h /lib64 rx /lib64/modules h /root /usr h /usr/lib64 rx /usr/sbin h /usr/sbin/logrotate rx /var h /var/lib rwcd /var/log rwcd -CAP_ALL +CAP_DAC_READ_SEARCH +CAP_SETGID +CAP_SETUID bind disabled connect disabled sock_allow_family unix inet ## Role: root

diff -u35 /mnt/H0214_g0n-r/root/grsec_170211_g0n_15-l /mnt/H0214_g0n-r/root/grsec_170211_g0n_16-l

Code: Select all: --- /mnt/H0214_g0n-r/root/grsec_170211_g0n_15-l 2017-02-11 19:40:40.707681756 +0100 +++ /mnt/H0214_g0n-r/root/grsec_170211_g0n_16-l 2017-02-11 19:48:40.761683195 +0100 @@ -1853,70 +1853,71 @@ /etc/localtime r /etc/nsswitch.conf r /lib64 rx /lib64/modules h /run rw /sbin h /sbin/agetty x /usr h /usr/lib64/locale/locale-archive r /usr/share/locale r /var h /var/log/wtmp w -CAP_ALL +CAP_CHOWN +CAP_DAC_OVERRIDE +CAP_FSETID +CAP_SYS_ADMIN +CAP_SYS_TTY_CONFIG bind disabled connect disabled # Role: root subject /sbin/init o / h /bin /bin/login x /dev h /dev/console rw /dev/initctl rw /dev/log rw /run h /run/utmp rw /sbin h /sbin/agetty x /usr/sbin/conntrackd r + /usr/sbin/libvirtd r /var h /var/log/wtmp w /var/lib/dhcpcd w -CAP_ALL bind disabled connect disabled # Role: root subject /sbin/installkernel o / h /bin x /boot wc /dev h /dev/tty rw /etc h /etc/ld.so.cache r /lib64 rx /lib64/modules h /proc h /proc/meminfo r /sbin h /sbin/installkernel r /usr h /usr/lib64/gconv/gconv-modules.cache r /usr/lib64/locale/locale-archive r # /usr/src/linux-3.18.5-hardened-r1 -CAP_ALL bind disabled connect disabled # Role: root subject /sbin/macchanger o / h /dev h /dev/hwrng r

diff -u35 /mnt/H0214_g0n-r/root/grsec_170211_g0n_16-l /mnt/H0214_g0n-r/root/grsec_170212_g0n_00-l

Code: Select all: --- /mnt/H0214_g0n-r/root/grsec_170211_g0n_16-l 2017-02-11 19:48:40.761683195 +0100 +++ /mnt/H0214_g0n-r/root/grsec_170212_g0n_00-l 2017-02-12 00:54:57.313738285 +0100 @@ -1853,71 +1853,70 @@ /etc/localtime r /etc/nsswitch.conf r /lib64 rx /lib64/modules h /run rw /sbin h /sbin/agetty x /usr h /usr/lib64/locale/locale-archive r /usr/share/locale r /var h /var/log/wtmp w -CAP_ALL +CAP_CHOWN +CAP_DAC_OVERRIDE +CAP_FSETID +CAP_SYS_ADMIN +CAP_SYS_TTY_CONFIG bind disabled connect disabled # Role: root subject /sbin/init o / h /bin /bin/login x /dev h /dev/console rw /dev/initctl rw /dev/log rw /run h /run/utmp rw /sbin h /sbin/agetty x /usr/sbin/conntrackd r - /usr/sbin/libvirtd r /var h /var/log/wtmp w /var/lib/dhcpcd w -CAP_ALL bind disabled connect disabled # Role: root subject /sbin/installkernel o / h /bin x /boot wc /dev h /dev/tty rw /etc h /etc/ld.so.cache r /lib64 rx /lib64/modules h /proc h /proc/meminfo r /sbin h /sbin/installkernel r /usr h /usr/lib64/gconv/gconv-modules.cache r /usr/lib64/locale/locale-archive r # /usr/src/linux-3.18.5-hardened-r1 -CAP_ALL bind disabled connect disabled # Role: root subject /sbin/macchanger o / h /dev h /dev/hwrng r @@ -7746,76 +7745,78 @@ /etc/gshadow- h /etc/shadow h /etc/shadow- h /etc/ssh h /etc/ssl h /etc/ssl/openssl.cnf r /home h /home/miro rwcd /lib/modules h /lib64 rx /lib64/modules h /proc r /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /run h /run/libvirt rw /sys h /usr h /usr/bin h /usr/bin/virsh rx /usr/lib64 rx /usr/sbin h /usr/sbin/libvirtd x /usr/share h /usr/share/locale r /usr/share/terminfo r /var/log h -CAP_ALL bind disabled connect disabled sock_allow_family unix inet ipv6 -## Role: miro -#subject /usr/bin/virt-install ol -# / h -# -CAP_ALL -# bind disabled -# connect disabled +# Role: miro +user_transition_allow root qemu +group_transition_allow root kvm libvirt qemu +subject /usr/bin/virt-install ol + / h + -CAP_ALL + bind disabled + connect disabled # Role: miro subject /usr/bin/wget o / h /Cmn rwc /Cmn/dLo rwcdl /dev h /dev/urandom r /etc r /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/passwd h /etc/shadow h /etc/shadow- h /etc/ssh h /etc/ssl h /etc/ssl/certs/ca-certificates.crt r /home /home/miro rwc /lib64 rx /lib64/modules h /mnt wc /proc /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /tmp rwcd /usr h /usr/bin h /usr/bin/wget rx /usr/lib64 rx

diff -u35 /mnt/H0214_g0n-r/root/grsec_170212_g0n_00-l /mnt/H0214_g0n-r/root/grsec_170212_g0n_01-l

Code: Select all: --- /mnt/H0214_g0n-r/root/grsec_170212_g0n_00-l 2017-02-12 00:54:57.313738285 +0100 +++ /mnt/H0214_g0n-r/root/grsec_170212_g0n_01-l 2017-02-12 01:03:08.173739757 +0100 @@ -6991,70 +6991,71 @@ /lib64/modules h /proc /proc/bus h /proc/kallsyms h /proc/kcore h /proc/meminfo r /proc/modules h /proc/slabinfo h /proc/sys h /usr h /usr/bin h /usr/bin/openssl rx /usr/lib64 h /usr/lib64/libcrypto.so.1.* rx /usr/lib64/libssl.so.1.* rx /usr/share r -CAP_ALL bind 0.0.0.0/32:0 dgram ip # connect 192.168.3.0/24:443 stream tcp connect 0.0.0.0/0:443 stream tcp connect 0.0.0.0/0:993 stream tcp connect 0.0.0.0/0:995 stream tcp connect 192.168.1.1/32:53 dgram udp # Role: miro subject /usr/bin/python2.7 o / h /etc h /etc/ld.so.cache r /lib64 rx /lib64/modules h /usr /usr/bin /usr/bin/python2.7 rx /usr/lib64 rx + /usr/share/virt-manager/virt-install rx /usr/src h -CAP_ALL bind disabled connect disabled sock_allow_family unix inet # Role: miro subject /usr/bin/python3.4m o / h /Cmn h /Cmn/Kaff rwcd /bin h /bin/bash x /dev h /dev/null rw /dev/urandom r /etc h /etc/hosts r /etc/ld.so.cache r /etc/localtime r /etc/mime.types r /etc/resolv.conf /lib64 rx /lib64/modules h /proc r /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /sbin h /sbin/ldconfig x /tmp rwcd /usr

diff -u35 /mnt/H0214_g0n-r/root/grsec_170212_g0n_01-l /mnt/H0214_g0n-r/root/grsec_170212_g0n_02-l

Code: Select all: --- /mnt/H0214_g0n-r/root/grsec_170212_g0n_01-l 2017-02-12 01:03:08.173739757 +0100 +++ /mnt/H0214_g0n-r/root/grsec_170212_g0n_02-l 2017-02-12 01:06:38.684740388 +0100 @@ -6985,70 +6985,71 @@ /etc/ssh h /etc/ssl h /etc/ssl/openssl.cnf r /home h /home/miro rw /lib64 rx /lib64/modules h /proc /proc/bus h /proc/kallsyms h /proc/kcore h /proc/meminfo r /proc/modules h /proc/slabinfo h /proc/sys h /usr h /usr/bin h /usr/bin/openssl rx /usr/lib64 h /usr/lib64/libcrypto.so.1.* rx /usr/lib64/libssl.so.1.* rx /usr/share r -CAP_ALL bind 0.0.0.0/32:0 dgram ip # connect 192.168.3.0/24:443 stream tcp connect 0.0.0.0/0:443 stream tcp connect 0.0.0.0/0:993 stream tcp connect 0.0.0.0/0:995 stream tcp connect 192.168.1.1/32:53 dgram udp # Role: miro subject /usr/bin/python2.7 o / h /etc h /etc/ld.so.cache r + /etc/localtime r /lib64 rx /lib64/modules h /usr /usr/bin /usr/bin/python2.7 rx /usr/lib64 rx /usr/share/virt-manager/virt-install rx /usr/src h -CAP_ALL bind disabled connect disabled sock_allow_family unix inet # Role: miro subject /usr/bin/python3.4m o / h /Cmn h /Cmn/Kaff rwcd /bin h /bin/bash x /dev h /dev/null rw /dev/urandom r /etc h /etc/hosts r /etc/ld.so.cache r /etc/localtime r /etc/mime.types r /etc/resolv.conf /lib64 rx /lib64/modules h /proc r /proc/bus h /proc/kallsyms h /proc/kcore h

diff -u35 /mnt/H0214_g0n-r/root/grsec_170212_g0n_02-l /mnt/H0214_g0n-r/root/grsec_170212_g0n_03-l

Code: Select all: --- /mnt/H0214_g0n-r/root/grsec_170212_g0n_02-l 2017-02-12 01:06:38.684740388 +0100 +++ /mnt/H0214_g0n-r/root/grsec_170212_g0n_03-l 2017-02-12 01:09:54.846740976 +0100 @@ -6981,87 +6981,75 @@ /etc/gshadow- h /etc/passwd h /etc/shadow h /etc/shadow- h /etc/ssh h /etc/ssl h /etc/ssl/openssl.cnf r /home h /home/miro rw /lib64 rx /lib64/modules h /proc /proc/bus h /proc/kallsyms h /proc/kcore h /proc/meminfo r /proc/modules h /proc/slabinfo h /proc/sys h /usr h /usr/bin h /usr/bin/openssl rx /usr/lib64 h /usr/lib64/libcrypto.so.1.* rx /usr/lib64/libssl.so.1.* rx /usr/share r -CAP_ALL bind 0.0.0.0/32:0 dgram ip # connect 192.168.3.0/24:443 stream tcp connect 0.0.0.0/0:443 stream tcp connect 0.0.0.0/0:993 stream tcp connect 0.0.0.0/0:995 stream tcp connect 192.168.1.1/32:53 dgram udp # Role: miro -subject /usr/bin/python2.7 o +subject /usr/bin/python2.7 ol / h - /etc h - /etc/ld.so.cache r - /etc/localtime r - /lib64 rx - /lib64/modules h - /usr - /usr/bin - /usr/bin/python2.7 rx - /usr/lib64 rx - /usr/share/virt-manager/virt-install rx - /usr/src h -CAP_ALL bind disabled connect disabled - sock_allow_family unix inet # Role: miro subject /usr/bin/python3.4m o / h /Cmn h /Cmn/Kaff rwcd /bin h /bin/bash x /dev h /dev/null rw /dev/urandom r /etc h /etc/hosts r /etc/ld.so.cache r /etc/localtime r /etc/mime.types r /etc/resolv.conf /lib64 rx /lib64/modules h /proc r /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /sbin h /sbin/ldconfig x /tmp rwcd /usr /usr/bin rx /usr/lib64 rx /usr/lib64/gconv h /usr/lib64/gconv/gconv-modules.cache r /usr/lib64/locale h

diff -u35 /mnt/H0214_g0n-r/root/grsec_170212_g0n_03-l /mnt/H0214_g0n-r/root/grsec_170212_g0n_04-l

Code: Select all: --- /mnt/H0214_g0n-r/root/grsec_170212_g0n_03-l 2017-02-12 01:09:54.846740976 +0100 +++ /mnt/H0214_g0n-r/root/grsec_170212_g0n_04-l 2017-02-12 01:21:22.755743038 +0100 @@ -3720,70 +3720,71 @@ /etc h /etc/group r /etc/libvirt rwcdl /etc/passwd r /proc r /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /proc/sys/kernel r # /proc/sys/kernel/cap_last_cap r /run h /run/libvirt wd /run/xtables.lock wcd /sbin h /sbin/xtables-multi x /sys h /sys/devices/system/cpu/online r /sys/devices/virtual/net/virbr1 r /usr h /usr/bin /usr/bin/qemu-system-x86_64 x /usr/sbin /usr/sbin/libvirtd rx /var/cache/libvirt rwcd -CAP_ALL +CAP_DAC_READ_SEARCH +CAP_KILL +CAP_NET_ADMIN +CAP_NET_RAW +CAP_SETUID +CAP_SETGID +CAP_DAC_OVERRIDE + +PAX_MPROTECT bind disabled connect disabled sock_allow_family all # Role: root subject /usr/sbin/logrotate o user_transition_allow nobody clamav root portage group_transition_allow nobody clamav root portage / h /bin h /bin/bash x /bin/gzip x /etc r /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/shadow h /etc/shadow- h /etc/ssh h /lib64 rx /lib64/modules h /root /usr h /usr/lib64 rx /usr/sbin h /usr/sbin/logrotate rx /var h /var/lib rwcd /var/log rwcd -CAP_ALL +CAP_DAC_READ_SEARCH +CAP_SETGID +CAP_SETUID bind disabled connect disabled

diff -u35 /mnt/H0214_g0n-r/root/grsec_170212_g0n_04-l /mnt/H0214_g0n-r/root/grsec_170212_g0n_06-l

Code: Select all: --- /mnt/H0214_g0n-r/root/grsec_170212_g0n_04-l 2017-02-12 01:21:22.755743038 +0100 +++ /mnt/H0214_g0n-r/root/grsec_170212_g0n_06-l 2017-02-12 01:35:49.066745635 +0100 @@ -3678,116 +3678,75 @@ /etc/passwd r /proc h /proc/sys/kernel/ngroups_max r /root r /tmp rwcd /usr/sbin/crond rx /usr h /usr/sbin/sendmail x /var h /var/spool/cron rwd -CAP_ALL +CAP_CHOWN +CAP_DAC_OVERRIDE +CAP_SETGID +CAP_SETUID +CAP_SYS_ADMIN bind disabled connect disabled sock_allow_family unix inet # Role: root subject /usr/sbin/gpm o / h /dev/input/mice rw /dev h /dev/tty* rw -CAP_ALL +CAP_SYS_ADMIN +CAP_SYS_TTY_CONFIG bind disabled connect disabled # Role: root user_transition_allow root qemu group_transition_allow root kvm libvirt qemu -subject /usr/sbin/libvirtd o +subject /usr/sbin/libvirtd ol / h - /dev h - /dev/kvm rw - /dev/net/tun rw - /dev/null rw - /dev/urandom r - /etc h - /etc/group r - /etc/libvirt rwcdl - /etc/passwd r - /proc r - /proc/bus h - /proc/kallsyms h - /proc/kcore h - /proc/modules h - /proc/slabinfo h - /proc/sys h - /proc/sys/kernel r -# /proc/sys/kernel/cap_last_cap r - /run h - /run/libvirt wd - /run/xtables.lock wcd - /sbin h - /sbin/xtables-multi x - /sys h - /sys/devices/system/cpu/online r - /sys/devices/virtual/net/virbr1 r - /usr h - /usr/bin - /usr/bin/qemu-system-x86_64 x - /usr/sbin - /usr/sbin/libvirtd rx - /var/cache/libvirt rwcd -CAP_ALL - +CAP_DAC_READ_SEARCH - +CAP_KILL - +CAP_NET_ADMIN - +CAP_NET_RAW - +CAP_SETUID - +CAP_SETGID - +CAP_DAC_OVERRIDE - +PAX_MPROTECT bind disabled connect disabled - sock_allow_family all # Role: root subject /usr/sbin/logrotate o user_transition_allow nobody clamav root portage group_transition_allow nobody clamav root portage / h /bin h /bin/bash x /bin/gzip x /etc r /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/shadow h /etc/shadow- h /etc/ssh h /lib64 rx /lib64/modules h /root /usr h /usr/lib64 rx /usr/sbin h /usr/sbin/logrotate rx /var h /var/lib rwcd /var/log rwcd -CAP_ALL +CAP_DAC_READ_SEARCH +CAP_SETGID +CAP_SETUID bind disabled connect disabled sock_allow_family unix inet ## Role: root

diff -u35 /mnt/H0214_g0n-r/root/grsec_170212_g0n_06-l /mnt/H0214_g0n-r/root/grsec_170212_g0n_07-l

Code: Select all: --- /mnt/H0214_g0n-r/root/grsec_170212_g0n_06-l 2017-02-12 01:35:49.066745635 +0100 +++ /mnt/H0214_g0n-r/root/grsec_170212_g0n_07-l 2017-02-12 01:33:14.894745173 +0100 @@ -3676,72 +3676,72 @@ /etc/group r /etc/localtime r /etc/passwd r /proc h /proc/sys/kernel/ngroups_max r /root r /tmp rwcd /usr/sbin/crond rx /usr h /usr/sbin/sendmail x /var h /var/spool/cron rwd -CAP_ALL +CAP_CHOWN +CAP_DAC_OVERRIDE +CAP_SETGID +CAP_SETUID +CAP_SYS_ADMIN bind disabled connect disabled sock_allow_family unix inet # Role: root subject /usr/sbin/gpm o / h /dev/input/mice rw /dev h /dev/tty* rw -CAP_ALL +CAP_SYS_ADMIN +CAP_SYS_TTY_CONFIG bind disabled connect disabled # Role: root -user_transition_allow root qemu -group_transition_allow root kvm libvirt qemu +user_transition_allow root miro qemu +group_transition_allow root miro kvm libvirt qemu subject /usr/sbin/libvirtd ol / h -CAP_ALL bind disabled connect disabled # Role: root subject /usr/sbin/logrotate o user_transition_allow nobody clamav root portage group_transition_allow nobody clamav root portage / h /bin h /bin/bash x /bin/gzip x /etc r /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/shadow h /etc/shadow- h /etc/ssh h /lib64 rx /lib64/modules h /root /usr h /usr/lib64 rx /usr/sbin h /usr/sbin/logrotate rx /var h /var/lib rwcd /var/log rwcd -CAP_ALL +CAP_DAC_READ_SEARCH +CAP_SETGID +CAP_SETUID

diff -u35 /mnt/H0214_g0n-r/root/grsec_170212_g0n_07-l /mnt/H0214_g0n-r/root/grsec_170212_g0n_08-l

Code: Select all: --- /mnt/H0214_g0n-r/root/grsec_170212_g0n_07-l 2017-02-12 01:33:14.894745173 +0100 +++ /mnt/H0214_g0n-r/root/grsec_170212_g0n_08-l 2017-02-12 13:48:20.284877396 +0100 @@ -7651,113 +7651,75 @@ /etc/terminfo/r/rxvt-unicode r /etc/vim /etc/vim/vimrc r /etc/vim/vimrc.local r /home h /home/miro rwcd /lib64 rx /lib64/modules h /mnt r /mnt/sd?1 rwcd /mnt/g* rwxcd /proc h /proc/meminfo r /sys h /tmp rwcd /usr /usr/bin x /usr/lib64 rx /usr/local h /usr/local/bin rw /usr/share rwc /usr/share/locale r /usr/src h /var h /var/lib /var/lib/lurker rwcdl /var/tmp rwcd /var/www /var/www/localhost/htdocs rwcdl /var/www/lurker* rwcd -CAP_ALL bind disabled connect disabled # Role: miro -subject /usr/bin/virsh o +subject /usr/bin/virsh ol / h - /boot h - /dev h - /dev/null rw - /dev/urandom r - /etc r - /etc/grsec h - /etc/gshadow h - /etc/gshadow- h - /etc/shadow h - /etc/shadow- h - /etc/ssh h - /etc/ssl h - /etc/ssl/openssl.cnf r - /home h - /home/miro rwcd - /lib/modules h - /lib64 rx - /lib64/modules h - /proc r - /proc/bus h - /proc/kallsyms h - /proc/kcore h - /proc/modules h - /proc/slabinfo h - /run h - /run/libvirt rw - /sys h - /usr h - /usr/bin h - /usr/bin/virsh rx - /usr/lib64 rx - /usr/sbin h - /usr/sbin/libvirtd x - /usr/share h - /usr/share/locale r - /usr/share/terminfo r - /var/log h -CAP_ALL bind disabled connect disabled - sock_allow_family unix inet ipv6 # Role: miro user_transition_allow root qemu group_transition_allow root kvm libvirt qemu subject /usr/bin/virt-install ol / h -CAP_ALL bind disabled connect disabled # Role: miro subject /usr/bin/wget o / h /Cmn rwc /Cmn/dLo rwcdl /dev h /dev/urandom r /etc r /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/passwd h /etc/shadow h /etc/shadow- h /etc/ssh h /etc/ssl h /etc/ssl/certs/ca-certificates.crt r /home /home/miro rwc /lib64 rx /lib64/modules h /mnt wc /proc /proc/bus h /proc/kallsyms h

diff -u35 /mnt/H0214_g0n-r/root/grsec_170212_g0n_08-l /mnt/H0214_g0n-r/root/grsec_170212_g0n_09-l

Code: Select all: --- /mnt/H0214_g0n-r/root/grsec_170212_g0n_08-l 2017-02-12 13:48:20.284877396 +0100 +++ /mnt/H0214_g0n-r/root/grsec_170212_g0n_09-l 2017-02-12 13:52:17.777878108 +0100 @@ -7651,70 +7651,72 @@ /etc/terminfo/r/rxvt-unicode r /etc/vim /etc/vim/vimrc r /etc/vim/vimrc.local r /home h /home/miro rwcd /lib64 rx /lib64/modules h /mnt r /mnt/sd?1 rwcd /mnt/g* rwxcd /proc h /proc/meminfo r /sys h /tmp rwcd /usr /usr/bin x /usr/lib64 rx /usr/local h /usr/local/bin rw /usr/share rwc /usr/share/locale r /usr/src h /var h /var/lib /var/lib/lurker rwcdl /var/tmp rwcd /var/www /var/www/localhost/htdocs rwcdl /var/www/lurker* rwcd -CAP_ALL bind disabled connect disabled # Role: miro +user_transition_allow root qemu +group_transition_allow root kvm libvirt qemu subject /usr/bin/virsh ol / h -CAP_ALL bind disabled connect disabled # Role: miro user_transition_allow root qemu group_transition_allow root kvm libvirt qemu subject /usr/bin/virt-install ol / h -CAP_ALL bind disabled connect disabled # Role: miro subject /usr/bin/wget o / h /Cmn rwc /Cmn/dLo rwcdl /dev h /dev/urandom r /etc r /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/passwd h /etc/shadow h /etc/shadow- h /etc/ssh h /etc/ssl h /etc/ssl/certs/ca-certificates.crt r /home /home/miro rwc /lib64 rx

I think I should add here (a little late in the process, I admit), that these files have funny paths, right. And they have those funny paths, because they're on a dd dumped system that is no longer alive, but frozen in history (short history, I'm joking), just for (primitive) data mining like this. Namely I first) do Air-Gapping [1], and second) I clone my master Air-Gapped system onto a same model hardware now machine [2], that can go online, but it always gets restored from clean, calm, quiet, no-internet, untouchable Air-Gapped master... ;-)

.

---

[1] Air-Gapped Gentoo Install, Tentative
https://forums.gentoo.org/viewtopic-t-987268.html

[2] Postfix smtp/TLS, Bkp/Cloning Mthd, Censorship/Intrusion
https://forums.gentoo.org/viewtopic-t-9 ... ml#7613044

by **timbgo** » Fri Mar 03, 2017 3:18 pm

Maybe about the augeas first:

equery f libvirt | grep 'usr/share/augeas/

Code: Select all: /usr/share/augeas/lenses /usr/share/augeas/lenses/libvirt_lockd.aug /usr/share/augeas/lenses/libvirtd.aug /usr/share/augeas/lenses/libvirtd_qemu.aug /usr/share/augeas/lenses/tests /usr/share/augeas/lenses/tests/test_libvirt_lockd.aug /usr/share/augeas/lenses/tests/test_libvirtd.aug /usr/share/augeas/lenses/tests/test_libvirtd_qemu.aug /usr/share/augeas/lenses/tests/test_virtlockd.aug /usr/share/augeas/lenses/tests/test_virtlogd.aug /usr/share/augeas/lenses/virtlockd.aug /usr/share/augeas/lenses/virtlogd.aug

But those are all just text files, with no function in my Gentoo. Just for clarity.

( augeas is not installed here:

Code: Select all: # eix app-admin/augeas * app-admin/augeas Available versions: 1.3.0 (~)1.5.0 (~)1.6.0 1.7.0 {static-libs test} Homepage: http://augeas.net/ Description: A library for changing configuration files #

)

But I haven't completed not even the learning configuration for virtualization.

While I can get even Tails running fine with pure Qemu:

Devuan's precursor's, as Tails, image in Qemu (10)
https://www.croatiafidelis.hr/foss/cap/ ... uan-10.php
(and with grsecurity's RBAC policy enabled, and also with iptables)

I haven't succeeded deploying libvirt to use via virt-manager's virt-install, this time around, yet.

I have today looked at errors in my Air-Gapped (where I practiced familiarizing with libvirt... after lots of reading of the documentation), and in my online clone.

In my online machine, where take notice, in the minimal context left, of the denied line, from this exceprt from syslog:

Code: Select all: Mar 1 20:11:10 g0n kernel: [365757.674875] grsec: (miro:U:/usr/bin/virsh) chdir to / by /usr/bin/virsh[virsh:15590] uid/euid:1000/1000 gid/egid:1000/1000, parent /usr/bin/virsh[virsh:15585] uid/euid:1000/1000 gid/egid:1000/1000 Mar 1 20:11:10 g0n kernel: [365757.677865] grsec: (miro:U:/usr/sbin/libvirtd) exec of /usr/sbin/libvirtd (/usr/sbin/libvirtd --timeout=30 ) by /usr/sbin/libvirtd[virsh:15592] uid/euid:1000/1000 gid/egid:1000/1000, parent /[virsh:15590] uid/euid:1000/1000 gid/egid:1000/1000 Mar 1 20:11:10 g0n kernel: [365757.759439] grsec: (:::kernel::::S:/) exec of /bin/kmod (/sbin/modprobe -q -- net-pf-16-proto-9 grsec_modharden_normal1000_ ) by /bin/kmod[kworker/u8:5:15610] uid/euid:0/0 gid/egid:0/0, parent /[kworker/u8:5:15531] uid/euid:0/0 gid/egid:0/0 Mar 1 20:11:10 g0n libvirtd: SQL engine 'mysql' not supported Mar 1 20:11:10 g0n libvirtd: auxpropfunc error no mechanism available Mar 1 20:11:10 g0n libvirtd: _sasl_plugin_load failed on sasl_auxprop_plug_init for plugin: sql Mar 1 20:11:10 g0n kernel: [365757.862197] grsec: (miro:U:/) exec of /usr/sbin/dnsmasq (/usr/sbin/dnsmasq --version ) by /usr/sbin/dnsmasq[libvirtd:15612] uid/euid:1000/1000 gid/egid:1000/1000, parent /usr/sbin/libvirtd[libvirtd:15611] uid/euid:1000/1000 gid/egid:1000/1000 Mar 1 20:11:10 g0n kernel: [365757.863063] grsec: (miro:U:/) denied executable mmap of /usr/sbin/dnsmasq by /usr/sbin/dnsmasq[dnsmasq:15612] uid/euid:1000/1000 gid/egid:1000/1000, parent /usr/sbin/libvirtd[libvirtd:15611] uid/euid:1000/1000 gid/egid:1000/1000 Mar 1 20:11:10 g0n kernel: [365757.863083] grsec: (miro:U:/) Segmentation fault occurred at (nil) in /usr/sbin/dnsmasq[dnsmasq:15612] uid/euid:1000/1000 gid/egid:1000/1000, parent /usr/sbin/libvirtd[libvirtd:15611] uid/euid:1000/1000 gid/egid:1000/1000 Mar 1 20:11:10 g0n kernel: [365757.863104] grsec: (miro:U:/usr/sbin/libvirtd) bruteforce prevention initiated for the next 30 minutes or until service restarted, stalling each fork 30 seconds. Please investigate the crash report for /usr/sbin/libvirtd[dnsmasq:15612] uid/euid:1000/1000 gid/egid:1000/1000, parent /usr/sbin/libvirtd[libvirtd:15611] uid/euid:1000/1000 gid/egid:1000/1000

And again, it's the denied lines, but these two are extracts from some 120k stretch of syslog:

Code: Select all: Mar 2 17:19:44 g0n kernel: [65470.993241] grsec: (admin:S:/) exec of /usr/bin/virsh (virsh -c qemu:///system net-destroy 220a72af-13b1-4655-b909-bf08e943028a ) by /usr/bin/virsh[openrc-run.sh:17662] uid/euid:0/0 gid/egid:0/0, parent /lib64/rc/sh/openrc-run.sh[openrc-run.sh:17429] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n dnsmasq[4289]: exiting on receipt of SIGTERM Mar 2 17:19:44 g0n kernel: [65471.007552] grsec: (default:D:/) denied unlink of /run/libvirt/network/default.pid by /usr/sbin/dnsmasq[dnsmasq:4289] uid/euid:65534/65534 gid/egid:65534/65534, parent /sbin/init[init:1] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n dhcpcd[3570]: virbr0-nic: removing interface Mar 2 17:19:44 g0n kernel: [65471.008552] device virbr0-nic left promiscuous mode Mar 2 17:19:44 g0n kernel: [65471.008557] virbr0: port 1(virbr0-nic) entered disabled state Mar 2 17:19:44 g0n kernel: [65471.010292] grsec: (root:U:/) exec of /lib64/udev/net.sh (/lib/udev/net.sh virbr0-nic stop ) by /lib64/udev/net.sh[udevd:17666] uid/euid:0/0 gid/egid:0/0, parent /sbin/udevd[udevd:17577] uid/euid:0/0 gid/egid:0/0

Code: Select all: Mar 2 17:19:44 g0n kernel: [65471.739919] grsec: (admin:S:/) exec of /usr/bin/virsh (virsh -c qemu:///system start 2823ce11-81b4-4c74-b465-2bb5980951c0 ) by /usr/bin/virsh[openrc-run.sh:17886] uid/euid:0/0 gid/egid:0/0, parent /lib64/rc/sh/openrc-run.sh[openrc-run.sh:17755] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n dhcpcd[3570]: virbr0: soliciting an IPv6 router Mar 2 17:19:44 g0n kernel: [65471.841180] grsec: (root:U:/) denied open of /var/log/libvirt/qemu/tails08.log for appending by /usr/sbin/virtlogd[virtlogd:4122] uid/euid:0/0 gid/egid:0/0, parent /sbin/init[init:1] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65471.841718] grsec: (root:U:/) denied open of /var/log/libvirt/qemu/tails08.log for appending by /usr/sbin/virtlogd[virtlogd:4122] uid/euid:0/0 gid/egid:0/0, parent /sbin/init[init:1] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:45 g0n kernel: [65471.880062] grsec: (admin:S:/) exec of /usr/bin/virsh (virsh -c qemu:///system domname 042b1507-6257-4e52-96b1-b9aef92e8b20 ) by /usr/bin/virsh[openrc-run.sh:17915] uid/euid:0/0 gid/egid:0/0, parent /lib64/rc/sh/openrc-run.sh[openrc-run.sh:17914] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:45 g0n kernel: [65471.880087] grsec: (admin:S:/) exec of /bin/head (head -n -1 ) by /bin/head[openrc-run.sh:17916] uid/euid:0/0 gid/egid:0/0, parent /lib64/rc/sh/openrc-run.sh[openrc-run.sh:17914] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:45 g0n kernel: [65471.895256] grsec: (admin:S:/) exec of /lib64/rc/bin/einfo (einfo tails09 ) by /lib64/rc/bin/einfo[openrc-run.sh:17918] uid/euid:0/0 gid/egid:0/0, parent /lib64/rc/sh/openrc-run.sh[openrc-run.sh:17755] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:45 g0n dhcpcd[3570]: virbr0: soliciting a DHCP lease Mar 2 17:19:45 g0n kernel: [65471.899073] grsec: (admin:S:/) exec of /usr/bin/virsh (virsh -c qemu:///system start 042b1507-6257-4e52-96b1-b9aef92e8b20 ) by /usr/bin/virsh[openrc-run.sh:17919] uid/euid:0/0 gid/egid:0/0, parent /lib64/rc/sh/openrc-run.sh[openrc-run.sh:17755] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:45 g0n kernel: [65471.900041] grsec: (admin:S:/) exec of /bin/head (head -n -1 ) by /bin/head[openrc-run.sh:17920] uid/euid:0/0 gid/egid:0/0, parent /lib64/rc/sh/openrc-run.sh[openrc-run.sh:17755] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:45 g0n kernel: [65471.995824] grsec: (root:U:/) denied open of /var/log/libvirt/qemu/tails09.log for appending by /usr/sbin/virtlogd[virtlogd:4122] uid/euid:0/0 gid/egid:0/0, parent /sbin/init[init:1] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:45 g0n kernel: [65471.996360] grsec: more alerts, logging disabled for 10 seconds

I plan to post some more about that "March 2 17:xx", because it's just the few missing touches, I believe, and some only related to grsecurity, that I need to do, and the long standing:

Whonix in Gentoo issues
https://forums.whonix.org/t/whonix-on-g ... ssues/3188

should be solved all or most of them. I'll post more about that "March 2 17:xx" syslog/events to:

... image in Qemu (11) [haven't decided about the title of that leg]
https://www.croatiafidelis.hr/foss/cap/ ... uan-11.php
(inexistent at the time of posting this to grsec forums)

And in my Air-Gapped:

Code: Select all: Mar 3 03:01:53 g5n kernel: [600465.812708] grsec: (admin:S:/) exec of /usr/sbin/sysctl (sysctl -w kernel/grsecurity/exec_logging=0 ) by /usr/sbin/sysctl[grsec_exec_audi:12428] uid/euid:0/0 gid/egid:0/0, parent /usr/local/bin/grsec_exec_audit.sh[grsec_exec_audi:12329] uid/euid:0/0 gid/egid:0/0 Mar 3 03:01:53 g5n kernel: [600465.812767] grsec: (admin:S:/) exec of /usr/sbin/sysctl (sysctl -w kernel/grsecurity/audit_chdir=0 ) by /usr/sbin/sysctl[grsec_exec_audi:12427] uid/euid:0/0 gid/egid:0/0, parent /usr/local/bin/grsec_exec_audit.sh[grsec_exec_audi:12330] uid/euid:0/0 gid/egid:0/0

The lines above are produced by the simple script that disables, and later enables exec_logging and audit_chdir. [1]

( so this is during user inactivity, dead of night )

Code: Select all: Mar 3 03:10:01 g5n run-crons[12463]: (root) CMD (/etc/cron.daily/logrotate) Mar 3 03:10:01 g5n run-crons[12469]: (root) CMD (/etc/cron.daily/man-db) Mar 3 03:10:06 g5n dnsmasq-dhcp[15291]: DHCPREQUEST(virbr0) 192.168.122.142 50:54:00:6d:ce:ec Mar 3 03:10:06 g5n dnsmasq-dhcp[15291]: DHCPACK(virbr0) 192.168.122.142 50:54:00:6d:ce:ec Mar 3 03:10:06 g5n kernel: [600958.838170] grsec: (root:U:/) denied create of /run/leaseshelper.pid for writing by /usr/libexec/libvirt_leaseshelper[libvirt_leasesh:12471] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/dnsmasq[dnsmasq:15292] uid/euid:0/0 gid/egid:0/0 Mar 3 03:10:06 g5n dnsmasq[15291]: script process exited with status 1 Mar 3 03:10:13 g5n run-crons[12869]: (root) CMD (/etc/cron.daily/mlocate) Mar 3 03:13:55 g5n kernel: [601187.781310] i2c i2c-0: sendbytes: NAK bailout. Mar 3 03:14:37 g5n run-crons[12897]: (root) CMD (/etc/cron.daily/rkhunter)

And a little later, after exec_logging and audit_chdir was back on, I have also the exec line:

Code: Select all: Mar 3 04:23:02 g5n kernel: [605334.941036] i2c i2c-0: sendbytes: NAK bailout. Mar 3 04:27:50 g5n dnsmasq-dhcp[15291]: DHCPREQUEST(virbr0) 192.168.122.73 50:54:00:93:d7:a2 Mar 3 04:27:50 g5n dnsmasq-dhcp[15291]: DHCPACK(virbr0) 192.168.122.73 50:54:00:93:d7:a2 Mar 3 04:27:50 g5n kernel: [605622.771431] grsec: (root:U:/) exec of /usr/libexec/libvirt_leaseshelper (libvirt_leaseshelper old 50:54:00:93:d7:a2 192.168.122.73 ) by /usr/libexec/libvirt_leaseshelper[dnsmasq:13079] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/dnsmasq[dnsmasq:15292] uid/euid:0/0 gid/egid:0/0 Mar 3 04:27:50 g5n kernel: [605622.778157] grsec: (root:U:/) denied create of /run/leaseshelper.pid for writing by /usr/libexec/libvirt_leaseshelper[libvirt_leasesh:13079] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/dnsmasq[dnsmasq:15292] uid/euid:0/0 gid/egid:0/0 Mar 3 04:27:50 g5n dnsmasq[15291]: script process exited with status 1

Obviously, some libvirt binaries don't have a chance to get the right permissions because I haven't set up any policies for their learning.

Looking up the listing of the libvirt (the listing that I grep'd only for augeas at the top):

equery f libvirt | grep -Ev '/usr/share/locale/|/usr/share/man/|/usr/share/libvirt/|/usr/share/gtk-doc/|/usr/share/doc/|/usr/share/locale/|/usr/share/augeas/|/var/lib'

Code: Select all: /etc /etc/conf.d /etc/conf.d/libvirt-guests /etc/conf.d/libvirtd /etc/init.d /etc/init.d/libvirt-guests /etc/init.d/libvirtd /etc/init.d/virtlockd /etc/init.d/virtlogd /etc/libvirt /etc/libvirt/libvirt-admin.conf ... /etc/logrotate.d /etc/logrotate.d/libvirtd /etc/logrotate.d/libvirtd.libxl /etc/logrotate.d/libvirtd.lxc /etc/logrotate.d/libvirtd.qemu /etc/logrotate.d/libvirtd.uml /etc/sasl2 /etc/sasl2/libvirt.conf /etc/systemd /etc/systemd/system /etc/systemd/system/libvirtd.service.d /etc/systemd/system/libvirtd.service.d/00gentoo.conf /usr /usr/bin /usr/bin/virsh /usr/bin/virt-admin /usr/bin/virt-host-validate /usr/bin/virt-login-shell /usr/bin/virt-pki-validate /usr/bin/virt-xml-validate /usr/include /usr/include/libvirt /usr/include/libvirt/libvirt-admin.h ... /usr/include/libvirt/virterror.h /usr/lib /usr/lib/sysctl.d /usr/lib/sysctl.d/60-libvirtd.conf /usr/lib/tmpfiles.d /usr/lib/tmpfiles.d/libvirtd.conf /usr/lib64 /usr/lib64/libnss_libvirt.so.2 /usr/lib64/libnss_libvirt_guest.so.2 /usr/lib64/libvirt /usr/lib64/libvirt-admin.so /usr/lib64/libvirt-admin.so.0 /usr/lib64/libvirt-admin.so.0.3000.0 /usr/lib64/libvirt-lxc.so /usr/lib64/libvirt-lxc.so.0 /usr/lib64/libvirt-lxc.so.0.3000.0 /usr/lib64/libvirt-qemu.so /usr/lib64/libvirt-qemu.so.0 /usr/lib64/libvirt-qemu.so.0.3000.0 /usr/lib64/libvirt.so /usr/lib64/libvirt.so.0 /usr/lib64/libvirt.so.0.3000.0 /usr/lib64/libvirt/connection-driver /usr/lib64/libvirt/connection-driver/libvirt_driver_network.so /usr/lib64/libvirt/connection-driver/libvirt_driver_nwfilter.so /usr/lib64/libvirt/connection-driver/libvirt_driver_qemu.so /usr/lib64/libvirt/connection-driver/libvirt_driver_secret.so /usr/lib64/libvirt/connection-driver/libvirt_driver_storage.so /usr/lib64/libvirt/lock-driver /usr/lib64/libvirt/lock-driver/lockd.so /usr/lib64/pkgconfig /usr/lib64/pkgconfig/libvirt-admin.pc /usr/lib64/pkgconfig/libvirt-lxc.pc /usr/lib64/pkgconfig/libvirt-qemu.pc /usr/lib64/pkgconfig/libvirt.pc /usr/libexec /usr/libexec/libvirt-guests.sh /usr/libexec/libvirt_iohelper /usr/libexec/libvirt_leaseshelper /usr/sbin /usr/sbin/libvirtd /usr/sbin/virtlockd /usr/sbin/virtlogd /usr/share /usr/share/augeas /usr/share/doc /usr/share/gtk-doc /usr/share/libvirt /usr/share/locale /usr/share/man /var

it can be seen that there are three groups of binaries that some of the members of might still need learning:

Code: Select all: /usr/bin/virsh /usr/bin/virt-admin /usr/bin/virt-host-validate /usr/bin/virt-login-shell /usr/bin/virt-pki-validate /usr/bin/virt-xml-validate

,

Code: Select all: /usr/libexec/libvirt-guests.sh /usr/libexec/libvirt_iohelper /usr/libexec/libvirt_leaseshelper

and

Code: Select all: /usr/sbin/libvirtd /usr/sbin/virtlockd /usr/sbin/virtlogd

.

I went without setting up learning for the remaining members of the first group, but I did set up learning for the remaining members of the second and third group.

And this is the diff of the last posted (by the timestamp) policy and the today's updated policy (as usual, it's my real life diff):

diff -u35 grsec_170226_g0n_00 grsec_170303_g0n_00

Code: Select all: --- grsec_170226_g0n_00 2017-02-26 19:54:17.760684150 +0100 +++ grsec_170303_g0n_00 2017-03-03 16:57:05.543259360 +0100 @@ -3556,115 +3556,151 @@ /dev/kmem h /dev/log h /dev/mem h /dev/null rw /dev/port h /dev/urandom r /etc h /root /root/.Xresources r /etc/ld.so.cache r /home/miro /home/miro/_Xresources* r /lib64 rx /lib64/modules h /proc h /proc/meminfo r /tmp w /usr /usr/include r /usr/lib64 rx /usr/libexec h /usr/libexec/gcc x /usr/share h /usr/share/locale r /usr/src rwxc /var/tmp rwcd -CAP_ALL bind 0.0.0.0/32:0 ip dgram stream tcp udp connect 127.0.0.1/32 ip dgram stream tcp udp connect 195.29.150.0/24 ip dgram stream tcp udp connect 178.218.165.68/32 ip dgram stream tcp udp bind disabled connect disabled # Role: root +subject /usr/libexec/libvirt-guests.sh ol +user_transition_allow qemu +group_transition_allow kvm libvirt qemu + / h + -CAP_ALL + bind disabled + connect disabled + +# Role: root +subject /usr/libexec/libvirt_iohelper ol +user_transition_allow qemu +group_transition_allow kvm libvirt qemu + / h + -CAP_ALL + bind disabled + connect disabled + +# Role: root +subject /usr/libexec/libvirt_leaseshelper ol +user_transition_allow qemu +group_transition_allow kvm libvirt qemu + / h + -CAP_ALL + bind disabled + connect disabled + +# Role: root subject /usr/libexec/postfix o user_transition_allow root postfix nobody miro group_transition_allow root postfix nobody miro / h /dev h /dev/log rw /dev/urandom r /etc r /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/shadow h /etc/shadow- h /etc/ssh h /home /home/miro /home/miro/Maildir rwcdl /lib64 rx /lib64/modules h /proc h /proc/sys/kernel/ngroups_max r /root /root/Maildir rwcdl /sys h /sys/devices/system/cpu/online r /usr h /usr/lib64 rx /usr/libexec x /var h /var/lib/postfix rwcd /var/spool/postfix rwcdl /var/tmp -CAP_ALL +CAP_DAC_READ_SEARCH +CAP_KILL +CAP_SETGID +CAP_SETUID bind 0.0.0.0/32:0 ip dgram stream tcp udp connect 127.0.0.1/32 ip dgram stream tcp udp connect 192.168.1.1/32:53 dgram udp connect 195.29.150.0/24 ip dgram stream tcp udp connect 178.218.165.68/32 ip dgram stream tcp udp sock_allow_family all # Role: root +subject /usr/libexec/qemu-bridge-helper ol +user_transition_allow qemu +group_transition_allow kvm libvirt qemu + / h + -CAP_ALL + bind disabled + connect disabled + +# Role: root subject /usr/sbin/apache2 o user_transition_allow apache group_transition_allow apache / h /etc h /etc/group r /proc h /proc/sys/kernel/ngroups_max r /run h /run/apache2.pid wd /run/cgisock* wd /usr h /usr/sbin/apache2 rx /var/log/apache2/cgi.log w -CAP_ALL +CAP_KILL +CAP_SETGID +CAP_SETUID bind disabled connect disabled sock_allow_family all # Role: root subject /usr/sbin/conntrackd o / h /etc /etc/localtime r /run/conntrackd.ctl wd /run/lock /run/lock/conntrack.lock wd /usr/sbin/conntrackd rx -CAP_ALL bind disabled connect disabled sock_allow_family unix inet @@ -3685,72 +3721,90 @@ /etc/localtime r /etc/passwd r /proc h /proc/sys/kernel/ngroups_max r /root r /tmp rwcd /usr/sbin/crond rx /usr h /usr/sbin/sendmail x /var h /var/spool/cron rwd -CAP_ALL +CAP_CHOWN +CAP_DAC_OVERRIDE +CAP_SETGID +CAP_SETUID +CAP_SYS_ADMIN bind disabled connect disabled sock_allow_family unix inet # Role: root subject /usr/sbin/gpm o / h /dev/input/mice rw /dev h /dev/tty* rw -CAP_ALL +CAP_SYS_ADMIN +CAP_SYS_TTY_CONFIG bind disabled connect disabled # Role: root subject /usr/sbin/libvirtd ol -user_transition_allow root miro qemu -group_transition_allow root miro kvm libvirt qemu +user_transition_allow qemu +group_transition_allow kvm libvirt qemu + / h + -CAP_ALL + bind disabled + connect disabled + +# Role: root +subject /usr/sbin/virtlockd ol +user_transition_allow qemu +group_transition_allow kvm libvirt qemu + / h + -CAP_ALL + bind disabled + connect disabled + +# Role: root +subject /usr/sbin/virtlogd ol +user_transition_allow qemu +group_transition_allow kvm libvirt qemu / h -CAP_ALL bind disabled connect disabled # Role: root subject /usr/sbin/logrotate o user_transition_allow nobody clamav root portage group_transition_allow nobody clamav root portage / h /bin h /bin/bash x /bin/gzip x /etc r /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/shadow h /etc/shadow- h /etc/ssh h /lib64 rx /lib64/modules h /root /usr h /usr/lib64 rx /usr/sbin h /usr/sbin/logrotate rx /var h /var/lib rwcd /var/log rwcd -CAP_ALL +CAP_DAC_READ_SEARCH +CAP_SETGID +CAP_SETUID bind disabled @@ -6031,70 +6085,73 @@ /usr/share/gdb r /usr/share/gdb/python r /usr/share/gdb/python/gdb rwcdl /usr/src h /tmp rwcd /var /var/tmp rwcd -CAP_ALL +CAP_SYS_PTRACE bind disabled connect disabled sock_allow_family unix inet # Role: miro subject /usr/bin/git o / /Cmn r /Cmn/src* rwcdl /bin /bin/bash x /boot h /dev h /dev/null rw /etc h /etc/host.conf r /etc/hosts r /etc/ld.so.cache r /etc/localtime r /etc/nsswitch.conf r /etc/resolv.conf r /home r /home/miro rwcdl /lib/modules h /lib64 rx /lib64/modules h + /mnt r + /mnt/g*/src* rwcdl + /mnt/H*/src* rwcdl /proc h /proc/meminfo r /proc/sys/vm/overcommit_memory r /sys h /sys/devices/system/cpu/online r /tmp rwcd /usr h /usr/bin rxl /usr/lib64 h /usr/lib64/gconv/gconv-modules.cache r /usr/lib64/locale/locale-archive r /usr/libexec x /usr/libexec/git-core rx /usr/local h /usr/local/bin /usr/share r /usr/share/locale r /usr/x86_64-pc-linux-gnu h /usr/x86_64-pc-linux-gnu/gcc-bin/5.4.0 /var /var/lib /var/lib/layman rwcdl /var/log h /var/www r /var/www/localhost rwcd -CAP_ALL bind 0.0.0.0/32:0 ip dgram stream tcp udp connect 0.0.0.0/32:443 stream dgram tcp udp connect 0.0.0.0/32:80 stream dgram tcp udp connect 0.0.0.0/0:53 stream dgram tcp udp connect 0.0.0.0/0:1024-65535 stream dgram tcp udp sock_allow_family unix inet # Role: miro subject /usr/bin/glxgears o @@ -7060,70 +7117,97 @@ /usr/lib64/python3.4/collections/__init__.py /usr/lib64/python3.4/collections/__pycache__/__init__.cpython-34.pyc r /usr/lib64/python3.4/ctypes /usr/lib64/python3.4/ctypes/__pycache__ r /usr/lib64/python3.4/encodings /usr/lib64/python3.4/encodings/__pycache__ r /usr/lib64/python3.4/html /usr/lib64/python3.4/html/__pycache__ r /usr/lib64/python3.4/json /usr/lib64/python3.4/json/__pycache__ r /usr/lib64/python3.4/lib-dynload rx /usr/lib64/python3.4/site-packages r /usr/lib64/python3.4/site-packages/youtube_dl r /usr/lib64/python3.4/site-packages/youtube_dl/__pycache__ rwc /usr/lib64/python3.4/xml r /usr/lib64/python3.4/xml/etree /usr/lib64/python3.4/xml/etree/__pycache__ r /usr/src h -CAP_ALL bind 0.0.0.0/32:0 dgram ip # connect 104.237.172.22/32:443 stream dgram tcp udp # connect 192.168.1.1/32:53 dgram udp connect disabled sock_allow_family ipv6 netlink # Role: miro subject /usr/bin/qemu-system-x86_64 ol user_transition_allow qemu group_transition_allow kvm libvirt qemu / h -CAP_ALL bind disabled connect disabled # Role: miro +subject /usr/libexec/libvirt-guests.sh ol +user_transition_allow qemu +group_transition_allow kvm libvirt qemu + / h + -CAP_ALL + bind disabled + connect disabled + +# Role: miro +subject /usr/libexec/libvirt_iohelper ol +user_transition_allow qemu +group_transition_allow kvm libvirt qemu + / h + -CAP_ALL + bind disabled + connect disabled + +# Role: miro +subject /usr/libexec/libvirt_leaseshelper ol +user_transition_allow qemu +group_transition_allow kvm libvirt qemu + / h + -CAP_ALL + bind disabled + connect disabled + +# Role: miro subject /usr/libexec/qemu-bridge-helper ol user_transition_allow qemu group_transition_allow kvm libvirt qemu / h -CAP_ALL bind disabled connect disabled # Role: miro subject /usr/bin/readcd o user_transition_allow miro nobody / h /Cmn h /Cmn/Kaff wc /Cmn/dLo wc /Cmn/MyVideos rwc /Cmn/gX* wc /Cmn/naibdX wc /Cmn/m* wc /dev h /dev/sg0 rw /etc h /etc/default/cdrecord r /etc/ld.so.cache r /lib64 h /lib64/ld-2.*.so x /lib64/libc-2.*.so rx /lib64/libcap.so.2.25 rx /proc /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h @@ -8023,70 +8107,73 @@ bind disabled connect disabled # Role: miro subject /usr/libexec/git-core o / h /Cmn r /Cmn/src* rwcdl /bin x /dev /dev/grsec h /dev/kmem h /dev/log h /dev/mem h /dev/null rw /dev/port h /dev/tty rw /dev/urandom r /etc r /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/passwd h /etc/shadow h /etc/shadow- h /etc/ssh h /etc/ssl h /etc/ssl/certs/ca-certificates.crt r /etc/ssl/openssl.cnf r /home /home/miro r /home/miro/.git-credential-cache rwcd /home/miro/public_html rw /lib64 rx /lib64/modules h + /mnt r + /mnt/g*/src* rwcdl + /mnt/H*/src* rwcdl /proc /proc/bus h /proc/kallsyms h /proc/kcore h /proc/meminfo r /proc/modules h /proc/slabinfo h /proc/sys h /usr h /usr/bin h /usr/bin/gettext.sh r /usr/bin/which x /usr/lib64 rx /usr/libexec rx /usr/share h /usr/share/locale r /var/tmp rwcdl /tmp rwcdl -CAP_ALL bind 0.0.0.0/32:0 dgram ip connect 0.0.0.0/0:80 stream dgram tcp udp connect 0.0.0.0/0:1-65535 stream dgram tcp udp connect 0.0.0.0/0:443 stream dgram tcp udp connect 0.0.0.0/0:81 stream dgram tcp udp connect 0.0.0.0/0:53 stream dgram tcp udp sock_allow_family ipv6 netlink # Role: miro subject /usr/libexec/gnupg/gpgkeys_hkp o / h /etc r /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/passwd h @@ -8602,72 +8689,90 @@ -CAP_ALL bind disabled connect disabled sock_allow_family unix inet subject /usr/local/bin/tzap-cat-g0.sh o / h /Cmn h /Cmn/Kaff wc /bin x /dev h /dev/null r /dev/tty rw /etc h /etc/ld.so.cache r /lib64 rx /lib64/modules h /usr h /usr/bin h /usr/bin/gawk x /usr/bin/tzap x /usr/lib64 h /usr/lib64/gconv/gconv-modules.cache r /usr/lib64/locale/locale-archive r /usr/local h /usr/local/bin/tzap-cat.sh rx /usr/share h /usr/share/locale r -CAP_ALL bind disabled connect disabled sock_allow_family unix inet # Role: miro subject /usr/sbin/libvirtd ol -user_transition_allow root miro qemu -group_transition_allow root miro kvm libvirt qemu +user_transition_allow qemu +group_transition_allow kvm libvirt qemu + / h + -CAP_ALL + bind disabled + connect disabled + +# Role: miro +subject /usr/sbin/virtlockd ol +user_transition_allow qemu +group_transition_allow kvm libvirt qemu + / h + -CAP_ALL + bind disabled + connect disabled + +# Role: miro +subject /usr/sbin/virtlogd ol +user_transition_allow qemu +group_transition_allow kvm libvirt qemu / h -CAP_ALL bind disabled connect disabled # Role: miro subject /usr/sbin/postdrop o / h /dev h /dev/log rw /etc r /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/postfix h /etc/postfix/main.cf r /etc/shadow h /etc/shadow- h /etc/ssh h /lib64 rx /lib64/modules h /usr h /usr/lib64 rx /usr/sbin h /usr/sbin/postdrop x /usr/share h /usr/share/zoneinfo r /var h /var/spool/postfix rwcd -CAP_ALL +CAP_SETGID +CAP_SETUID bind 0.0.0.0/32:0 stream tcp udp connect 127.0.0.1/32 ip dgram stream tcp udp sock_allow_family all

---
[1] The sript that I set to execute at that time, because else some cron jobs, mainly rkhunter, but also mlocate and man-db, create cca 10-20MB of excessive text (within just a few minutes!):

cat /usr/local/bin/grsec_exec_audit.sh

Code: Select all: #!/bin/bash if [ $# -eq 0 ]; then echo "give number of seconds from now, and exec_logging" echo "along with audit_chdir" echo "will be disabled and 3000 seconds later reenabled." echo "(Or give along with that first arg above explained," echo "second arg, and that many seconds on from then" echo "will the duration be that exec_logging and" echo "audit_chdir will be disabled.)" exit 0 fi if [ "$2" ]; then #echo \$1: $1;echo \$2: $2; #read FAKE # this was previously: the wait plus the duration, instead of just the duration #duration=$(echo $1+$2|bc) duration=$2 #echo \$duration: $duration #read FAKE sleep $1 && \ sysctl -w kernel/grsecurity/exec_logging=0 && \ sleep $duration && \ sysctl -w kernel/grsecurity/exec_logging=1 & sleep $1 && \ sysctl -w kernel/grsecurity/audit_chdir=0 && \ sleep $duration && \ sysctl -w kernel/grsecurity/audit_chdir=1 & else sleep $1 && \ sysctl -w kernel/grsecurity/exec_logging=0 && \ sleep 3000 && \ sysctl -w kernel/grsecurity/exec_logging=1 & sleep $1 && \ sysctl -w kernel/grsecurity/audit_chdir=0 && \ sleep 3000 && \ sysctl -w kernel/grsecurity/audit_chdir=1 & fi

EDIT 2017-04-02 16:51+02:00: applied this patch on the previous grsec_exec_audit.sh:

Code: Select all: 15c15,17 < duration=$(echo $1+$2|bc) --- > # this was previously: the wait plus the duration, insted of just the duration > #duration=$(echo $1+$2|bc) > duration=$2

---
Miroslav Rovis
Zagreb, Croatia
http://www.CroatiaFidelis.hr
Try refute: rootkit hooks in kernel,
linux capabilities for intrusion? (Linus?)

by **timbgo** » Sun Mar 05, 2017 1:19 pm

I have been looking for several periods in the last some three days now into the several issues remaining to get the libvirt and relatives running while protected with grsec RBAC policies.

Some of these issues show through the errors in my Air-Gapped and in my online clone when starting VMs.

There is also another issue which is not grsecurity RBAC policies related, and I described it in:

Whonix on Gentoo issues
https://forums.whonix.org/t/whonix-on-g ... es/3188/17

But the other issues are RBAC policies related.

The successful run of Tails I described in the link already given, and it was with full deployment of RBAC policies, although with most of the libvirt and associated groups, users and subjects still set to only learning yet, as described so far in this topic.

---
And I think that at this point I should briefly, for completeness, also point the newbie readers to how I installed iptables, which were also fully deployed in that successful run of three days ago now:

https://web.archive.org/web/20140701061 ... -firewall/
( the original page has been, sadly, down for a year or longer )
Also, in the page I already gave, there may be a few more tips:
Postfix smtp/TLS, Bkp/Cloning Mthd, Censorship/Intrusion
https://forums.gentoo.org/viewtopic-t-999436.html
(search for "iptables")
---

But, as I'll show in the next post, I have had changes that led to an apparent dead end with setting up my policies. And I was thinking I'd post the logs, very verbose, but kept much shorter than what I will post in the:

Devuan's precursor's, as Tails, image in Qemu (11), part 2
https://www.croatiafidelis.hr/foss/cap/ ... 11.php#No1

because I haven't got a clue why the, as you will see (in the next post), the dnsmasq errors just wouldn't go away.

These logs are just what happens after:

Code: Select all: # service libvirtd restart # service libvirt-guests restart

and it might be that the understanding of it is necessary to set the right RBAC policies.

Important to note is also that a few seconds short of two minutes after the libvirtd and libvirt-guests restarting, which restarting happened offline, I set up the usual procedure with uncenz-1st run and with physically plugging in the wire to the cable to connect to internet, and successfully ran Tails..

First the user (me, as root) issued service libvirtd restart:

Code: Select all: Mar 2 17:19:17 g0n kernel: [65444.399413] grsec: (admin:S:/) exec of /sbin/service (service libvirtd restart ) by /sbin/service[bash:17172] uid/euid:0/0 gid/egid:0/0, parent /bin/bash[bash:4692] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:17 g0n kernel: [65444.400846] grsec: (admin:S:/) exec of /etc/init.d/libvirtd (/etc/init.d/libvirtd restart ) by /etc/init.d/libvirtd[service:17172] uid/euid:0/0 gid/egid:0/0, parent /bin/bash[bash:4692] uid/euid:0/0 gid/egid:0/0

Next the libvirt springs to action.

Code: Select all: Mar 2 17:19:17 g0n kernel: [65444.677291] grsec: (:::kernel::::S:/) exec of /bin/kmod (/sbin/modprobe -q -- net-pf-16-proto-9 ) by /bin/kmod[kworker/u8:3:17240] uid/euid:0/0 gid/egid:0/0, parent /[kworker/u8:3:17077] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:17 g0n libvirtd: SQL engine 'mysql' not supported Mar 2 17:19:17 g0n libvirtd: auxpropfunc error no mechanism available Mar 2 17:19:17 g0n libvirtd: _sasl_plugin_load failed on sasl_auxprop_plug_init for plugin: sql Mar 2 17:19:17 g0n kernel: [65444.691588] grsec: (admin:S:/) exec of /lib64/rc/bin/eend (eend 0 Failed to start libvirtd ) by /lib64/rc/bin/eend[openrc-run.sh:17243] uid/euid:0/0 gid/egid:0/0, parent /lib64/rc/sh/openrc-run.sh[openrc-run.sh:17202] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:17 g0n kernel: [65444.701016] grsec: (admin:S:/) exec of /usr/sbin/dnsmasq (/usr/sbin/dnsmasq --version ) by /usr/sbin/dnsmasq[libvirtd:17242] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17241] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:17 g0n kernel: [65444.735433] grsec: (admin:S:/) exec of /lib64/rc/bin/service_set_value (service_set_value command /usr/sbin/libvirtd ) by /lib64/rc/bin/service_set_value[openrc-run.sh:17244] uid/euid:0/0 gid/egid:0/0, parent /lib64/rc/sh/openrc-run.sh[openrc-run.sh:17202] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:17 g0n kernel: [65444.736694] grsec: (admin:S:/) exec of /usr/sbin/dnsmasq (/usr/sbin/dnsmasq --help ) by /usr/sbin/dnsmasq[libvirtd:17245] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17241] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:17 g0n kernel: [65444.743371] grsec: (admin:S:/) exec of /lib64/rc/bin/service_set_value (service_set_value pidfile /var/run/libvirtd.pid ) by /lib64/rc/bin/service_set_value[openrc-run.sh:17246] uid/euid:0/0 gid/egid:0/0, parent /lib64/rc/sh/openrc-run.sh[openrc-run.sh:17202] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:17 g0n kernel: [65444.776615] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w -L -n ) by /sbin/xtables-multi[libvirtd:17251] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17241] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:17 g0n kernel: [65444.783592] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/ip6tables -w -L -n ) by /sbin/xtables-multi[libvirtd:17252] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17241] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:17 g0n kernel: [65444.796545] grsec: (admin:S:/) exec of /sbin/ebtables (/sbin/ebtables --concurrent -L ) by /sbin/ebtables[libvirtd:17253] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17241] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:17 g0n kernel: [65444.837584] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --table mangle --delete POSTROUTING --out-interface virbr0 --protocol udp --destination-port 68 --jump CHECKSU) by /sbin/xtables-multi[libvirtd:17254] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17241] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:17 g0n kernel: [65444.842581] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --table nat --delete POSTROUTING --source 192.168.122.0/24 --destination 224.0.0.0/24 --jump RETURN ) by /sbin/xtables-multi[libvirtd:17255] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17241] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:17 g0n kernel: [65444.846103] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --table nat --delete POSTROUTING --source 192.168.122.0/24 --destination 255.255.255.255/32 --jump RETURN ) by /sbin/xtables-multi[libvirtd:17256] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17241] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:18 g0n kernel: [65444.851485] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --table nat --delete POSTROUTING --source 192.168.122.0/24 -p tcp ! --destination 192.168.122.0/24 --jump MASQ) by /sbin/xtables-multi[libvirtd:17257] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17241] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:18 g0n kernel: [65444.855608] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --table nat --delete POSTROUTING --source 192.168.122.0/24 -p udp ! --destination 192.168.122.0/24 --jump MASQ) by /sbin/xtables-multi[libvirtd:17258] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17241] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:18 g0n kernel: [65444.860190] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --table nat --delete POSTROUTING --source 192.168.122.0/24 ! --destination 192.168.122.0/24 --jump MASQUERADE ) by /sbin/xtables-multi[libvirtd:17259] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17241] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:18 g0n kernel: [65444.863698] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --table filter --delete FORWARD --destination 192.168.122.0/24 --out-interface virbr0 --match conntrack --ctst) by /sbin/xtables-multi[libvirtd:17260] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17241] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:18 g0n kernel: [65444.866085] xt_physdev: using --physdev-out and --physdev-is-out are only supported in the FORWARD and POSTROUTING chains with bridged traffic. Mar 2 17:19:18 g0n kernel: [65444.866091] xt_physdev: using --physdev-out and --physdev-is-out are only supported in the FORWARD and POSTROUTING chains with bridged traffic. Mar 2 17:19:18 g0n kernel: [65444.866095] xt_physdev: using --physdev-out and --physdev-is-out are only supported in the FORWARD and POSTROUTING chains with bridged traffic. Mar 2 17:19:18 g0n kernel: [65444.866098] xt_physdev: using --physdev-out and --physdev-is-out are only supported in the FORWARD and POSTROUTING chains with bridged traffic.

The sequence of the 4 lines above repeat a lot below, while of all the fifth lines to those four, I leave all of them intact... (in the first round --and I'm trying to keep it as complete as possible--) :

Code: Select all: Mar 2 17:19:18 g0n kernel: [65444.868044] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --table filter --delete FORWARD --source 192.168.122.0/24 --in-interface virbr0 --jump ACCEPT ) by /sbin/xtables-multi[libvirtd:17261] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17241] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:18 g0n kernel: [65444.872135] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --table filter --delete FORWARD --in-interface virbr0 --out-interface virbr0 --jump ACCEPT ) by /sbin/xtables-multi[libvirtd:17262] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17241] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:18 g0n kernel: [65444.876132] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --table filter --delete FORWARD --out-interface virbr0 --jump REJECT ) by /sbin/xtables-multi[libvirtd:17263] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17241] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:18 g0n kernel: [65444.880589] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --table filter --delete FORWARD --in-interface virbr0 --jump REJECT ) by /sbin/xtables-multi[libvirtd:17264] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17241] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:18 g0n kernel: [65444.884585] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --table filter --delete INPUT --in-interface virbr0 --protocol udp --destination-port 53 --jump ACCEPT ) by /sbin/xtables-multi[libvirtd:17265] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17241] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:18 g0n kernel: [65444.890590] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --table filter --delete INPUT --in-interface virbr0 --protocol tcp --destination-port 53 --jump ACCEPT ) by /sbin/xtables-multi[libvirtd:17266] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17241] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:18 g0n kernel: [65444.895599] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --table filter --delete OUTPUT --out-interface virbr0 --protocol udp --destination-port 68 --jump ACCEPT ) by /sbin/xtables-multi[libvirtd:17267] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17241] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:18 g0n kernel: [65444.900603] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --table filter --delete INPUT --in-interface virbr0 --protocol udp --destination-port 67 --jump ACCEPT ) by /sbin/xtables-multi[libvirtd:17268] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17241] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:18 g0n kernel: [65444.906592] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --table filter --delete INPUT --in-interface virbr0 --protocol tcp --destination-port 67 --jump ACCEPT ) by /sbin/xtables-multi[libvirtd:17269] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17241] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:18 g0n kernel: [65444.913150] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --table filter --insert INPUT --in-interface virbr0 --protocol tcp --destination-port 67 --jump ACCEPT ) by /sbin/xtables-multi[libvirtd:17270] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17241] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:18 g0n kernel: [65444.917588] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --table filter --insert INPUT --in-interface virbr0 --protocol udp --destination-port 67 --jump ACCEPT ) by /sbin/xtables-multi[libvirtd:17271] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17241] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:18 g0n kernel: [65444.922131] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --table filter --insert OUTPUT --out-interface virbr0 --protocol udp --destination-port 68 --jump ACCEPT ) by /sbin/xtables-multi[libvirtd:17272] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17241] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:18 g0n kernel: [65444.928159] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --table filter --insert INPUT --in-interface virbr0 --protocol tcp --destination-port 53 --jump ACCEPT ) by /sbin/xtables-multi[libvirtd:17273] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17241] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:18 g0n kernel: [65444.939601] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --table filter --insert INPUT --in-interface virbr0 --protocol udp --destination-port 53 --jump ACCEPT ) by /sbin/xtables-multi[libvirtd:17274] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17241] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:18 g0n kernel: [65444.945224] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --table filter --insert FORWARD --in-interface virbr0 --jump REJECT ) by /sbin/xtables-multi[libvirtd:17275] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17241] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:18 g0n kernel: [65444.950589] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --table filter --insert FORWARD --out-interface virbr0 --jump REJECT ) by /sbin/xtables-multi[libvirtd:17276] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17241] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:18 g0n kernel: [65444.954583] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --table filter --insert FORWARD --in-interface virbr0 --out-interface virbr0 --jump ACCEPT ) by /sbin/xtables-multi[libvirtd:17277] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17241] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:18 g0n kernel: [65444.959611] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --table filter --insert FORWARD --source 192.168.122.0/24 --in-interface virbr0 --jump ACCEPT ) by /sbin/xtables-multi[libvirtd:17278] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17241] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:18 g0n kernel: [65444.964594] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --table filter --insert FORWARD --destination 192.168.122.0/24 --out-interface virbr0 --match conntrack --ctst) by /sbin/xtables-multi[libvirtd:17279] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17241] uid/euid:0/0 gid/egid:0/0

So, again, all the lines in the section above, had four lines like the below (which are just like the first four such lines in the section further above).

Code: Select all: Mar 2 17:19:18 g0n kernel: [65444.966974] xt_physdev: using --physdev-out and --physdev-is-out are only supported in the FORWARD and POSTROUTING chains with bridged traffic. Mar 2 17:19:18 g0n kernel: [65444.966980] xt_physdev: using --physdev-out and --physdev-is-out are only supported in the FORWARD and POSTROUTING chains with bridged traffic. Mar 2 17:19:18 g0n kernel: [65444.966983] xt_physdev: using --physdev-out and --physdev-is-out are only supported in the FORWARD and POSTROUTING chains with bridged traffic. Mar 2 17:19:18 g0n kernel: [65444.966987] xt_physdev: using --physdev-out and --physdev-is-out are only supported in the FORWARD and POSTROUTING chains with bridged traffic.

There, the 4 lines are identical but for the "[some.number]" after "Mar 2 17:19:18 g0n kernel:".

Code: Select all: Mar 2 17:19:18 g0n kernel: [65444.970603] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --table nat --insert POSTROUTING --source 192.168.122.0/24 ! --destination 192.168.122.0/24 --jump MASQUERADE ) by /sbin/xtables-multi[libvirtd:17280] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17241] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:18 g0n kernel: [65444.976599] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --table nat --insert POSTROUTING --source 192.168.122.0/24 -p udp ! --destination 192.168.122.0/24 --jump MASQ) by /sbin/xtables-multi[libvirtd:17281] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17241] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:18 g0n kernel: [65444.980844] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --table nat --insert POSTROUTING --source 192.168.122.0/24 -p tcp ! --destination 192.168.122.0/24 --jump MASQ) by /sbin/xtables-multi[libvirtd:17282] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17241] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:18 g0n kernel: [65444.985115] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --table nat --insert POSTROUTING --source 192.168.122.0/24 --destination 255.255.255.255/32 --jump RETURN ) by /sbin/xtables-multi[libvirtd:17283] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17241] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:18 g0n kernel: [65444.989863] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --table nat --insert POSTROUTING --source 192.168.122.0/24 --destination 224.0.0.0/24 --jump RETURN ) by /sbin/xtables-multi[libvirtd:17284] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17241] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:18 g0n kernel: [65444.993678] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --table mangle --insert POSTROUTING --out-interface virbr0 --protocol udp --destination-port 68 --jump CHECKSU) by /sbin/xtables-multi[libvirtd:17285] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17241] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:18 g0n kernel: [65444.997853] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --table filter --delete FORWARD --in-interface virbr1 --out-interface virbr1 --jump ACCEPT ) by /sbin/xtables-multi[libvirtd:17286] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17241] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:18 g0n kernel: [65444.999923] xt_physdev: using --physdev-out and --physdev-is-out are only supported in the FORWARD and POSTROUTING chains with bridged traffic. Mar 2 17:19:18 g0n kernel: [65444.999928] xt_physdev: using --physdev-out and --physdev-is-out are only supported in the FORWARD and POSTROUTING chains with bridged traffic. Mar 2 17:19:18 g0n kernel: [65444.999931] xt_physdev: using --physdev-out and --physdev-is-out are only supported in the FORWARD and POSTROUTING chains with bridged traffic. Mar 2 17:19:18 g0n kernel: [65444.999935] xt_physdev: using --physdev-out and --physdev-is-out are only supported in the FORWARD and POSTROUTING chains with bridged traffic.

The 2nd batch of syslog lines.
The same 4 lines just above, again, and removing them from just a little further below. The fifth line to the above four.

Code: Select all: Mar 2 17:19:18 g0n kernel: [65445.002128] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --table filter --delete FORWARD --out-interface virbr1 --jump REJECT ) by /sbin/xtables-multi[libvirtd:17287] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17241] uid/euid:0/0 gid/egid:0/0

The difference btwn the first batch of syslog lines that I struggle hard to abbreviate, and this second, is just, apparently:

"virbr0" in the first batch

"virbr1" in the second batch

In this meantime below, the dnsmasq said its statements, else, the 4 proverbial lines are same.

Code: Select all: Mar 2 17:19:18 g0n kernel: [65445.064606] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --table filter --insert FORWARD --in-interface virbr1 --out-interface virbr1 --jump ACCEPT ) by /sbin/xtables-multi[libvirtd:17301] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17241] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:18 g0n dnsmasq[4289]: read /etc/hosts - 16 addresses Mar 2 17:19:18 g0n dnsmasq[4289]: read /var/lib/libvirt/dnsmasq/default.addnhosts - 0 addresses Mar 2 17:19:18 g0n dnsmasq-dhcp[4289]: read /var/lib/libvirt/dnsmasq/default.hostsfile Mar 2 17:19:18 g0n kernel: [65445.066591] xt_physdev: using --physdev-out and --physdev-is-out are only supported in the FORWARD and POSTROUTING chains with bridged traffic. Mar 2 17:19:18 g0n kernel: [65445.066596] xt_physdev: using --physdev-out and --physdev-is-out are only supported in the FORWARD and POSTROUTING chains with bridged traffic. Mar 2 17:19:18 g0n kernel: [65445.066599] xt_physdev: using --physdev-out and --physdev-is-out are only supported in the FORWARD and POSTROUTING chains with bridged traffic. Mar 2 17:19:18 g0n kernel: [65445.066602] xt_physdev: using --physdev-out and --physdev-is-out are only supported in the FORWARD and POSTROUTING chains with bridged traffic. Mar 2 17:19:18 g0n kernel: [65445.627181] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --version ) by /sbin/xtables-multi[libvirtd:17302] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17241] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:18 g0n kernel: [65445.664718] grsec: (admin:S:/) exec of /usr/sbin/dmidecode (/usr/sbin/dmidecode -q -t 0,1,2,4,17 ) by /usr/sbin/dmidecode[libvirtd:17303] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17241] uid/euid:0/0 gid/egid:0/0

Next the user (me, as root) issued service libvirt-guests restart:

Code: Select all: Mar 2 17:19:23 g0n kernel: [65450.352993] grsec: (admin:S:/) exec of /sbin/service (service libvirt-guests restart ) by /sbin/service[bash:17426] uid/euid:0/0 gid/egid:0/0, parent /bin/bash[bash:4692] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:23 g0n kernel: [65450.366030] grsec: (admin:S:/) exec of /etc/init.d/libvirt-guests (/etc/init.d/libvirt-guests restart ) by /etc/init.d/libvirt-guests[service:17426] uid/euid:0/0 gid/egid:0/0, parent /bin/bash[bash:4692] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:23 g0n kernel: [65450.367647] grsec: (admin:S:/) chdir to / by /etc/init.d/libvirt-guests[libvirt-guests:17426] uid/euid:0/0 gid/egid:0/0, parent /bin/bash[bash:4692] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:23 g0n kernel: [65450.378699] grsec: (admin:S:/) exec of /lib64/rc/sh/openrc-run.sh (/lib64/rc/sh/openrc-run.sh /etc/init.d/libvirt-guests stop ) by /lib64/rc/sh/openrc-run.sh[libvirt-guests:17429] uid/euid:0/0 gid/egid:0/0, parent /etc/init.d/libvirt-guests[libvirt-guests:17426] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:23 g0n kernel: [65450.385664] grsec: (admin:S:/) exec of /lib64/rc/bin/eval_ecolors (eval_ecolors ) by /lib64/rc/bin/eval_ecolors[openrc-run.sh:17432] uid/euid:0/0 gid/egid:0/0, parent /lib64/rc/sh/openrc-run.sh[openrc-run.sh:17431] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:23 g0n kernel: [65450.410679] grsec: (admin:S:/) exec of /bin/mkdir (mkdir -p /sys/fs/cgroup/openrc/libvirt-guests ) by /bin/mkdir[openrc-run.sh:17434] uid/euid:0/0 gid/egid:0/0, parent /lib64/rc/sh/openrc-run.sh[openrc-run.sh:17429] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:23 g0n kernel: [65450.411481] grsec: (admin:S:/) chdir to /sys by /bin/mkdir[mkdir:17434] uid/euid:0/0 gid/egid:0/0, parent /lib64/rc/sh/openrc-run.sh[openrc-run.sh:17429] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:23 g0n kernel: [65450.411496] grsec: (admin:S:/) chdir to /sys/fs by /bin/mkdir[mkdir:17434] uid/euid:0/0 gid/egid:0/0, parent /lib64/rc/sh/openrc-run.sh[openrc-run.sh:17429] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:23 g0n kernel: [65450.411509] grsec: (admin:S:/) chdir to /sys/fs/cgroup by /bin/mkdir[mkdir:17434] uid/euid:0/0 gid/egid:0/0, parent /lib64/rc/sh/openrc-run.sh[openrc-run.sh:17429] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:23 g0n kernel: [65450.411523] grsec: (admin:S:/) chdir to /sys/fs/cgroup/openrc by /bin/mkdir[mkdir:17434] uid/euid:0/0 gid/egid:0/0, parent /lib64/rc/sh/openrc-run.sh[openrc-run.sh:17429] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:23 g0n kernel: [65450.413673] grsec: (admin:S:/) exec of /bin/mkdir (mkdir -p /sys/fs/cgroup/openrc/libvirt-guests ) by /bin/mkdir[openrc-run.sh:17435] uid/euid:0/0 gid/egid:0/0, parent /lib64/rc/sh/openrc-run.sh[openrc-run.sh:17429] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:23 g0n kernel: [65450.413712] grsec: (:::kernel::::S:/) exec of /lib64/rc/sh/cgroup-release-agent.sh (/lib64/rc/sh/cgroup-release-agent.sh /libvirt-guests ) by /lib64/rc/sh/cgroup-release-agent.sh[kworker/u8:4:17436] uid/euid:0/0 gid/egid:0/0, parent /[kthreadd:2] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:23 g0n kernel: [65450.414429] grsec: (admin:S:/) chdir to /sys by /bin/mkdir[mkdir:17435] uid/euid:0/0 gid/egid:0/0, parent /lib64/rc/sh/openrc-run.sh[openrc-run.sh:17429] uid/euid:0/0 gid/egid:0/0

( a lot is cut here )

Code: Select all: Mar 2 17:19:43 g0n dhcpcd[3570]: virbr0: carrier lost Mar 2 17:19:43 g0n kernel: [65470.199044] grsec: (root:U:/lib64/dhcpcd/dhcpcd-run-hooks) exec of /lib64/dhcpcd/dhcpcd-run-hooks (/lib/dhcpcd/dhcpcd-run-hooks ) by /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd:17613] uid/euid:0/0 gid/egid:0/0, parent /sbin/dhcpcd[dhcpcd:3570] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:43 g0n kernel: [65470.209073] grsec: (root:U:/) exec of /usr/bin/cmp (cmp -s /etc/resolv.conf /run/dhcpcd/resolv.conf.virbr0.dhcp ) by /usr/bin/cmp[dhcpcd-run-hook:17615] uid/euid:0/0 gid/egid:0/0, parent /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd-run-hook:17613] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:43 g0n kernel: [65470.211014] grsec: (root:U:/bin/rm) exec of /bin/rm (rm -f /run/dhcpcd/resolv.conf.virbr0.dhcp ) by /bin/rm[dhcpcd-run-hook:17616] uid/euid:0/0 gid/egid:0/0, parent /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd-run-hook:17613] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:43 g0n kernel: [65470.214135] grsec: (root:U:/bin/rm) exec of /bin/rm (rm -f /run/dhcpcd/resolv.conf.virbr0.dhcp ) by /bin/rm[dhcpcd-run-hook:17617] uid/euid:0/0 gid/egid:0/0, parent /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd-run-hook:17613] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:43 g0n dhcpcd[3570]: virbr0: deleting default route Mar 2 17:19:43 g0n dhcpcd[3570]: virbr0: deleting route to 169.254.0.0/16 Mar 2 17:19:43 g0n kernel: [65470.237130] grsec: (root:U:/lib64/dhcpcd/dhcpcd-run-hooks) exec of /lib64/dhcpcd/dhcpcd-run-hooks (/lib/dhcpcd/dhcpcd-run-hooks ) by /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd:17619] uid/euid:0/0 gid/egid:0/0, parent /sbin/dhcpcd[dhcpcd:3570] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:43 g0n kernel: [65470.245274] grsec: (root:U:/) exec of /usr/bin/cmp (cmp -s /etc/resolv.conf /run/dhcpcd/resolv.conf.virbr0.ipv4ll ) by /usr/bin/cmp[dhcpcd-run-hook:17621] uid/euid:0/0 gid/egid:0/0, parent /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd-run-hook:17619] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:43 g0n kernel: [65470.247107] grsec: (root:U:/bin/rm) exec of /bin/rm (rm -f /run/dhcpcd/resolv.conf.virbr0.ipv4ll ) by /bin/rm[dhcpcd-run-hook:17622] uid/euid:0/0 gid/egid:0/0, parent /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd-run-hook:17619] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:43 g0n kernel: [65470.248634] grsec: (root:U:/bin/rm) exec of /bin/rm (rm -f /run/dhcpcd/resolv.conf.virbr0.ipv4ll ) by /bin/rm[dhcpcd-run-hook:17623] uid/euid:0/0 gid/egid:0/0, parent /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd-run-hook:17619] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:43 g0n kernel: [65470.258821] grsec: (root:U:/lib64/dhcpcd/dhcpcd-run-hooks) exec of /lib64/dhcpcd/dhcpcd-run-hooks (/lib/dhcpcd/dhcpcd-run-hooks ) by /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd:17625] uid/euid:0/0 gid/egid:0/0, parent /sbin/dhcpcd[dhcpcd:3570] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:43 g0n kernel: [65470.267369] grsec: (root:U:/) exec of /usr/bin/cmp (cmp -s /etc/resolv.conf /run/dhcpcd/resolv.conf.virbr0.dhcp ) by /usr/bin/cmp[dhcpcd-run-hook:17627] uid/euid:0/0 gid/egid:0/0, parent /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd-run-hook:17625] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:43 g0n kernel: [65470.271035] grsec: (root:U:/bin/rm) exec of /bin/rm (rm -f /run/dhcpcd/resolv.conf.virbr0.dhcp ) by /bin/rm[dhcpcd-run-hook:17628] uid/euid:0/0 gid/egid:0/0, parent /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd-run-hook:17625] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:43 g0n kernel: [65470.274056] grsec: (root:U:/bin/rm) exec of /bin/rm (rm -f /run/dhcpcd/resolv.conf.virbr0.dhcp ) by /bin/rm[dhcpcd-run-hook:17629] uid/euid:0/0 gid/egid:0/0, parent /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd-run-hook:17625] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65470.862051] grsec: (admin:S:/) exec of /bin/head (head -n -1 ) by /bin/head[openrc-run.sh:17635] uid/euid:0/0 gid/egid:0/0, parent /lib64/rc/sh/openrc-run.sh[openrc-run.sh:17632] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65470.862753] grsec: (admin:S:/) exec of /usr/bin/virsh (virsh -c qemu:///system list --uuid --persistent ) by /usr/bin/virsh[openrc-run.sh:17634] uid/euid:0/0 gid/egid:0/0, parent /lib64/rc/sh/openrc-run.sh[openrc-run.sh:17632] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65470.877451] grsec: (admin:S:/) exec of /bin/wc (wc -l ) by /bin/wc[openrc-run.sh:17633] uid/euid:0/0 gid/egid:0/0, parent /lib64/rc/sh/openrc-run.sh[openrc-run.sh:17631] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65470.881049] grsec: (admin:S:/) exec of /lib64/rc/bin/einfo (einfo Shutting down domain(s) ... ) by /lib64/rc/bin/einfo[openrc-run.sh:17637] uid/euid:0/0 gid/egid:0/0, parent /lib64/rc/sh/openrc-run.sh[openrc-run.sh:17429] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65470.886051] grsec: (admin:S:/) exec of /bin/head (head -n -1 ) by /bin/head[openrc-run.sh:17640] uid/euid:0/0 gid/egid:0/0, parent /lib64/rc/sh/openrc-run.sh[openrc-run.sh:17638] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65470.887032] grsec: (admin:S:/) exec of /usr/bin/virsh (virsh -c qemu:///system list --uuid --transient ) by /usr/bin/virsh[openrc-run.sh:17639] uid/euid:0/0 gid/egid:0/0, parent /lib64/rc/sh/openrc-run.sh[openrc-run.sh:17638] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65470.909979] grsec: (admin:S:/) exec of /usr/bin/virsh (virsh -c qemu:///system list --uuid --transient ) by /usr/bin/virsh[openrc-run.sh:17645] uid/euid:0/0 gid/egid:0/0, parent /lib64/rc/sh/openrc-run.sh[openrc-run.sh:17643] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65470.910049] grsec: (admin:S:/) exec of /bin/wc (wc -l ) by /bin/wc[openrc-run.sh:17644] uid/euid:0/0 gid/egid:0/0, parent /lib64/rc/sh/openrc-run.sh[openrc-run.sh:17642] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65470.915042] grsec: (admin:S:/) exec of /bin/head (head -n -1 ) by /bin/head[openrc-run.sh:17646] uid/euid:0/0 gid/egid:0/0, parent /lib64/rc/sh/openrc-run.sh[openrc-run.sh:17643] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65470.930729] grsec: (admin:S:/) exec of /bin/head (head -n -1 ) by /bin/head[openrc-run.sh:17650] uid/euid:0/0 gid/egid:0/0, parent /lib64/rc/sh/openrc-run.sh[openrc-run.sh:17648] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65470.931065] grsec: (admin:S:/) exec of /usr/bin/virsh (virsh -c qemu:///system list --uuid --transient ) by /usr/bin/virsh[openrc-run.sh:17649] uid/euid:0/0 gid/egid:0/0, parent /lib64/rc/sh/openrc-run.sh[openrc-run.sh:17648] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65470.948055] grsec: (admin:S:/) exec of /lib64/rc/bin/einfo (einfo Shutting down network(s): ) by /lib64/rc/bin/einfo[openrc-run.sh:17652] uid/euid:0/0 gid/egid:0/0, parent /lib64/rc/sh/openrc-run.sh[openrc-run.sh:17429] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65470.951180] grsec: (admin:S:/) exec of /usr/bin/virsh (virsh -c qemu:///system net-list --uuid --persistent ) by /usr/bin/virsh[openrc-run.sh:17654] uid/euid:0/0 gid/egid:0/0, parent /lib64/rc/sh/openrc-run.sh[openrc-run.sh:17653] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65470.954418] grsec: (admin:S:/) exec of /bin/head (head -n -1 ) by /bin/head[openrc-run.sh:17655] uid/euid:0/0 gid/egid:0/0, parent /lib64/rc/sh/openrc-run.sh[openrc-run.sh:17653] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65470.970085] grsec: (admin:S:/) exec of /usr/bin/virsh (virsh -c qemu:///system net-name 220a72af-13b1-4655-b909-bf08e943028a ) by /usr/bin/virsh[openrc-run.sh:17658] uid/euid:0/0 gid/egid:0/0, parent /lib64/rc/sh/openrc-run.sh[openrc-run.sh:17657] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65470.972131] grsec: (admin:S:/) exec of /bin/head (head -n -1 ) by /bin/head[openrc-run.sh:17659] uid/euid:0/0 gid/egid:0/0, parent /lib64/rc/sh/openrc-run.sh[openrc-run.sh:17657] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65470.988048] grsec: (admin:S:/) exec of /lib64/rc/bin/einfo (einfo default ) by /lib64/rc/bin/einfo[openrc-run.sh:17661] uid/euid:0/0 gid/egid:0/0, parent /lib64/rc/sh/openrc-run.sh[openrc-run.sh:17429] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65470.991334] grsec: (admin:S:/) exec of /bin/head (head -n -1 ) by /bin/head[openrc-run.sh:17663] uid/euid:0/0 gid/egid:0/0, parent /lib64/rc/sh/openrc-run.sh[openrc-run.sh:17429] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65470.993241] grsec: (admin:S:/) exec of /usr/bin/virsh (virsh -c qemu:///system net-destroy 220a72af-13b1-4655-b909-bf08e943028a ) by /usr/bin/virsh[openrc-run.sh:17662] uid/euid:0/0 gid/egid:0/0, parent /lib64/rc/sh/openrc-run.sh[openrc-run.sh:17429] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n dnsmasq[4289]: exiting on receipt of SIGTERM Mar 2 17:19:44 g0n kernel: [65471.007552] grsec: (default:D:/) denied unlink of /run/libvirt/network/default.pid by /usr/sbin/dnsmasq[dnsmasq:4289] uid/euid:65534/65534 gid/egid:65534/65534, parent /sbin/init[init:1] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n dhcpcd[3570]: virbr0-nic: removing interface Mar 2 17:19:44 g0n kernel: [65471.008552] device virbr0-nic left promiscuous mode Mar 2 17:19:44 g0n kernel: [65471.008557] virbr0: port 1(virbr0-nic) entered disabled state Mar 2 17:19:44 g0n kernel: [65471.010292] grsec: (root:U:/) exec of /lib64/udev/net.sh (/lib/udev/net.sh virbr0-nic stop ) by /lib64/udev/net.sh[udevd:17666] uid/euid:0/0 gid/egid:0/0, parent /sbin/udevd[udevd:17577] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65471.012031] grsec: (:::kernel::::S:/) exec of /bin/kmod (/sbin/modprobe -q -- netdev-virbr0-nic ) by /bin/kmod[kworker/u8:3:17665] uid/euid:0/0 gid/egid:0/0, parent /[kworker/u8:3:17077] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65471.015108] grsec: (:::kernel::::S:/) exec of /bin/kmod (/sbin/modprobe -q -- virbr0-nic grsec_modharden_netdev ) by /bin/kmod[kworker/u8:3:17667] uid/euid:0/0 gid/egid:0/0, parent /[kworker/u8:3:17077] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65471.016836] grsec: (root:U:/lib64/dhcpcd/dhcpcd-run-hooks) exec of /lib64/dhcpcd/dhcpcd-run-hooks (/lib/dhcpcd/dhcpcd-run-hooks ) by /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd:17668] uid/euid:0/0 gid/egid:0/0, parent /sbin/dhcpcd[dhcpcd:3570] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65471.026051] grsec: (root:U:/) exec of /usr/bin/cmp (cmp -s /etc/resolv.conf /run/dhcpcd/resolv.conf.virbr0-nic.dhcp ) by /usr/bin/cmp[dhcpcd-run-hook:17670] uid/euid:0/0 gid/egid:0/0, parent /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd-run-hook:17668] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65471.027951] grsec: (root:U:/bin/rm) exec of /bin/rm (rm -f /run/dhcpcd/resolv.conf.virbr0-nic.dhcp ) by /bin/rm[dhcpcd-run-hook:17671] uid/euid:0/0 gid/egid:0/0, parent /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd-run-hook:17668] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65471.030682] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --table mangle --delete POSTROUTING --out-interface virbr0 --protocol udp --destination-port 68 --jump CHECKSU) by /sbin/xtables-multi[libvirtd:17673] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17227] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65471.030896] grsec: (root:U:/bin/rm) exec of /bin/rm (rm -f /run/dhcpcd/resolv.conf.virbr0-nic.dhcp ) by /bin/rm[dhcpcd-run-hook:17672] uid/euid:0/0 gid/egid:0/0, parent /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd-run-hook:17668] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65471.035040] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --table nat --delete POSTROUTING --source 192.168.122.0/24 --destination 224.0.0.0/24 --jump RETURN ) by /sbin/xtables-multi[libvirtd:17674] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17227] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n dhcpcd[3570]: virbr0: new hardware address: 00:00:00:00:00:00 Mar 2 17:19:44 g0n kernel: [65471.041047] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --table nat --delete POSTROUTING --source 192.168.122.0/24 --destination 255.255.255.255/32 --jump RETURN ) by /sbin/xtables-multi[libvirtd:17676] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17227] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65471.046044] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --table nat --delete POSTROUTING --source 192.168.122.0/24 -p tcp ! --destination 192.168.122.0/24 --jump MASQ) by /sbin/xtables-multi[libvirtd:17677] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17227] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65471.050617] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --table nat --delete POSTROUTING --source 192.168.122.0/24 -p udp ! --destination 192.168.122.0/24 --jump MASQ) by /sbin/xtables-multi[libvirtd:17678] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17227] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65471.056626] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --table nat --delete POSTROUTING --source 192.168.122.0/24 ! --destination 192.168.122.0/24 --jump MASQUERADE ) by /sbin/xtables-multi[libvirtd:17679] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17227] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65471.061616] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --table filter --delete FORWARD --destination 192.168.122.0/24 --out-interface virbr0 --match conntrack --ctst) by /sbin/xtables-multi[libvirtd:17680] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17227] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65471.064123] xt_physdev: using --physdev-out and --physdev-is-out are only supported in the FORWARD and POSTROUTING chains with bridged traffic. Mar 2 17:19:44 g0n kernel: [65471.064129] xt_physdev: using --physdev-out and --physdev-is-out are only supported in the FORWARD and POSTROUTING chains with bridged traffic. Mar 2 17:19:44 g0n kernel: [65471.064132] xt_physdev: using --physdev-out and --physdev-is-out are only supported in the FORWARD and POSTROUTING chains with bridged traffic. Mar 2 17:19:44 g0n kernel: [65471.064135] xt_physdev: using --physdev-out and --physdev-is-out are only supported in the FORWARD and POSTROUTING chains with bridged traffic. Mar 2 17:19:44 g0n kernel: [65471.066049] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --table filter --delete FORWARD --source 192.168.122.0/24 --in-interface virbr0 --jump ACCEPT ) by /sbin/xtables-multi[libvirtd:17681] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17227] uid/euid:0/0 gid/egid:0/0

...

Maybe here follows the main point. Why is it that dnsmasq works below, and in my later attempts, that I will post next, it consistently fails.

Code: Select all: Mar 2 17:19:44 g0n kernel: [65471.491046] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --table filter --insert FORWARD --destination 192.168.122.0/24 --out-interface virbr0 --match conntrack --ctst) by /sbin/xtables-multi[libvirtd:17814] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17226] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65471.493588] xt_physdev: using --physdev-out and --physdev-is-out are only supported in the FORWARD and POSTROUTING chains with bridged traffic. Mar 2 17:19:44 g0n kernel: [65471.493593] xt_physdev: using --physdev-out and --physdev-is-out are only supported in the FORWARD and POSTROUTING chains with bridged traffic. Mar 2 17:19:44 g0n kernel: [65471.493596] xt_physdev: using --physdev-out and --physdev-is-out are only supported in the FORWARD and POSTROUTING chains with bridged traffic. Mar 2 17:19:44 g0n kernel: [65471.493599] xt_physdev: using --physdev-out and --physdev-is-out are only supported in the FORWARD and POSTROUTING chains with bridged traffic. Mar 2 17:19:44 g0n dhcpcd[3570]: virbr0-nic: IAID 00:ea:ee:e9 Mar 2 17:19:44 g0n dhcpcd[3570]: virbr0: carrier acquired Mar 2 17:19:44 g0n kernel: [65471.496050] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --table nat --insert POSTROUTING --source 192.168.122.0/24 ! --destination 192.168.122.0/24 --jump MASQUERADE ) by /sbin/xtables-multi[libvirtd:17815] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17226] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65471.497285] grsec: (root:U:/lib64/dhcpcd/dhcpcd-run-hooks) exec of /lib64/dhcpcd/dhcpcd-run-hooks (/lib/dhcpcd/dhcpcd-run-hooks ) by /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd:17816] uid/euid:0/0 gid/egid:0/0, parent /sbin/dhcpcd[dhcpcd:3570] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65471.500348] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --table nat --insert POSTROUTING --source 192.168.122.0/24 -p udp ! --destination 192.168.122.0/24 --jump MASQ) by /sbin/xtables-multi[libvirtd:17817] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17226] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65471.504150] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --table nat --insert POSTROUTING --source 192.168.122.0/24 -p tcp ! --destination 192.168.122.0/24 --jump MASQ) by /sbin/xtables-multi[libvirtd:17818] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17226] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n dhcpcd[3570]: virbr0: IAID 00:ea:ee:e9 Mar 2 17:19:44 g0n dhcpcd[3570]: virbr0: IAID conflicts with one assigned to virbr0-nic Mar 2 17:19:44 g0n dhcpcd[3570]: virbr0: adding address fe80::7e36:b0a1:9718:3d3a Mar 2 17:19:44 g0n dhcpcd[3570]: if_addaddress6: Permission denied Mar 2 17:19:44 g0n kernel: [65471.509054] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --table nat --insert POSTROUTING --source 192.168.122.0/24 --destination 255.255.255.255/32 --jump RETURN ) by /sbin/xtables-multi[libvirtd:17819] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17226] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65471.512510] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --table nat --insert POSTROUTING --source 192.168.122.0/24 --destination 224.0.0.0/24 --jump RETURN ) by /sbin/xtables-multi[libvirtd:17820] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17226] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65471.516373] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --table mangle --insert POSTROUTING --out-interface virbr0 --protocol udp --destination-port 68 --jump CHECKSU) by /sbin/xtables-multi[libvirtd:17821] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17226] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65471.526947] grsec: (admin:S:/) exec of /usr/sbin/dnsmasq (/usr/sbin/dnsmasq --version ) by /usr/sbin/dnsmasq[libvirtd:17822] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17226] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n dhcpcd[3570]: virbr0-nic: soliciting an IPv6 router Mar 2 17:19:44 g0n kernel: [65471.532054] grsec: (admin:S:/) exec of /usr/sbin/dnsmasq (/usr/sbin/dnsmasq --help ) by /usr/sbin/dnsmasq[libvirtd:17823] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17226] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65471.537689] grsec: (admin:S:/) exec of /usr/sbin/dnsmasq (/usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default.conf --leasefile-ro --dhcp-script=/usr/libexec/libvirt_leaseshelp) by /usr/sbin/dnsmasq[libvirtd:17824] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17226] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65471.542047] grsec: (admin:S:/) exec of /bin/bash (sh -c /usr/libexec/libvirt_leaseshelper init ) by /bin/bash[dnsmasq:17825] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/dnsmasq[dnsmasq:17824] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65471.548921] grsec: (admin:S:/) exec of /usr/libexec/libvirt_leaseshelper (/usr/libexec/libvirt_leaseshelper init ) by /usr/libexec/libvirt_leaseshelper[sh:17825] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/dnsmasq[dnsmasq:17824] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65471.555262] grsec: (admin:S:/) chdir to / by /usr/sbin/dnsmasq[dnsmasq:17824] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17226] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n dnsmasq[17827]: started, version 2.76 cachesize 150 Mar 2 17:19:44 g0n dnsmasq[17827]: compile time options: IPv6 GNU-getopt no-DBus i18n IDN DHCP DHCPv6 no-Lua no-TFTP conntrack ipset no-auth no-DNSSEC loop-detect inotify Mar 2 17:19:44 g0n dnsmasq-dhcp[17827]: DHCP, IP range 192.168.122.2 -- 192.168.122.254, lease time 1h Mar 2 17:19:44 g0n dnsmasq-dhcp[17827]: DHCP, sockets bound exclusively to interface virbr0 Mar 2 17:19:44 g0n dnsmasq[17827]: no servers found in /etc/resolv.conf, will retry Mar 2 17:19:44 g0n dnsmasq[17827]: read /etc/hosts - 16 addresses Mar 2 17:19:44 g0n dnsmasq[17827]: read /var/lib/libvirt/dnsmasq/default.addnhosts - 0 addresses Mar 2 17:19:44 g0n dnsmasq-dhcp[17827]: read /var/lib/libvirt/dnsmasq/default.hostsfile Mar 2 17:19:44 g0n dhcpcd[3570]: virbr0-nic: carrier lost Mar 2 17:19:44 g0n kernel: [65471.560063] grsec: (root:U:/lib64/dhcpcd/dhcpcd-run-hooks) exec of /lib64/dhcpcd/dhcpcd-run-hooks (/lib/dhcpcd/dhcpcd-run-hooks ) by /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd:17829] uid/euid:0/0 gid/egid:0/0, parent /sbin/dhcpcd[dhcpcd:3570] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65471.569254] grsec: (root:U:/) exec of /usr/bin/cmp (cmp -s /etc/resolv.conf /run/dhcpcd/resolv.conf.virbr0-nic.dhcp ) by /usr/bin/cmp[dhcpcd-run-hook:17831] uid/euid:0/0 gid/egid:0/0, parent /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd-run-hook:17829] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65471.571273] grsec: (root:U:/bin/rm) exec of /bin/rm (rm -f /run/dhcpcd/resolv.conf.virbr0-nic.dhcp ) by /bin/rm[dhcpcd-run-hook:17832] uid/euid:0/0 gid/egid:0/0, parent /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd-run-hook:17829] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65471.574011] grsec: (root:U:/bin/rm) exec of /bin/rm (rm -f /run/dhcpcd/resolv.conf.virbr0-nic.dhcp ) by /bin/rm[dhcpcd-run-hook:17833] uid/euid:0/0 gid/egid:0/0, parent /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd-run-hook:17829] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65471.576702] virbr0: port 1(virbr0-nic) entered disabled state Mar 2 17:19:44 g0n kernel: [65471.581115] grsec: (admin:S:/) exec of /bin/head (head -n -1 ) by /bin/head[openrc-run.sh:17837] uid/euid:0/0 gid/egid:0/0, parent /lib64/rc/sh/openrc-run.sh[openrc-run.sh:17835] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65471.581757] grsec: (admin:S:/) exec of /usr/bin/virsh (virsh -c qemu:///system net-name 7e4f38ed-8848-485e-b610-808c9e3bf0d8 ) by /usr/bin/virsh[openrc-run.sh:17836] uid/euid:0/0 gid/egid:0/0, parent /lib64/rc/sh/openrc-run.sh[openrc-run.sh:17835] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65471.600075] grsec: (admin:S:/) exec of /lib64/rc/bin/einfo (einfo Whonix ) by /lib64/rc/bin/einfo[openrc-run.sh:17839] uid/euid:0/0 gid/egid:0/0, parent /lib64/rc/sh/openrc-run.sh[openrc-run.sh:17755] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65471.603061] grsec: (admin:S:/) exec of /usr/bin/virsh (virsh -c qemu:///system net-start 7e4f38ed-8848-485e-b610-808c9e3bf0d8 ) by /usr/bin/virsh[openrc-run.sh:17840] uid/euid:0/0 gid/egid:0/0, parent /lib64/rc/sh/openrc-run.sh[openrc-run.sh:17755] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65471.603289] grsec: (admin:S:/) exec of /bin/head (head -n -1 ) by /bin/head[openrc-run.sh:17841] uid/euid:0/0 gid/egid:0/0, parent /lib64/rc/sh/openrc-run.sh[openrc-run.sh:17755] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65471.616851] virbr1: port 1(virbr1-nic) entered blocking state Mar 2 17:19:44 g0n kernel: [65471.616855] virbr1: port 1(virbr1-nic) entered disabled state Mar 2 17:19:44 g0n kernel: [65471.616949] device virbr1-nic entered promiscuous mode Mar 2 17:19:44 g0n kernel: [65471.618045] grsec: (root:U:/) exec of /lib64/udev/net.sh (/lib/udev/net.sh virbr1 start ) by /lib64/udev/net.sh[udevd:17843] uid/euid:0/0 gid/egid:0/0, parent /sbin/udevd[udevd:17786] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65471.619047] grsec: (root:U:/) exec of /lib64/udev/net.sh (/lib/udev/net.sh virbr1-nic start ) by /lib64/udev/net.sh[udevd:17845] uid/euid:0/0 gid/egid:0/0, parent /sbin/udevd[udevd:17577] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65471.619426] grsec: (:::kernel::::S:/) exec of /bin/kmod (/sbin/modprobe -q -- net-pf-16-proto-16-family-nl80211 ) by /bin/kmod[kworker/u8:3:17844] uid/euid:0/0 gid/egid:0/0, parent /[kworker/u8:3:17077] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65471.622039] grsec: (root:U:/lib64/dhcpcd/dhcpcd-run-hooks) exec of /lib64/dhcpcd/dhcpcd-run-hooks (/lib/dhcpcd/dhcpcd-run-hooks ) by /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd:17846] uid/euid:0/0 gid/egid:0/0, parent /sbin/dhcpcd[dhcpcd:3570] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65471.630919] grsec: (root:U:/lib64/dhcpcd/dhcpcd-run-hooks) exec of /lib64/dhcpcd/dhcpcd-run-hooks (/lib/dhcpcd/dhcpcd-run-hooks ) by /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd:17847] uid/euid:0/0 gid/egid:0/0, parent /sbin/dhcpcd[dhcpcd:3570] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65471.639071] grsec: (root:U:/) exec of /usr/bin/cmp (cmp -s /etc/resolv.conf /run/dhcpcd/resolv.conf.virbr1.dhcp ) by /usr/bin/cmp[dhcpcd-run-hook:17850] uid/euid:0/0 gid/egid:0/0, parent /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd-run-hook:17847] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65471.641052] grsec: (root:U:/bin/rm) exec of /bin/rm (rm -f /run/dhcpcd/resolv.conf.virbr1.dhcp ) by /bin/rm[dhcpcd-run-hook:17851] uid/euid:0/0 gid/egid:0/0, parent /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd-run-hook:17847] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65471.642516] grsec: (root:U:/bin/rm) exec of /bin/rm (rm -f /run/dhcpcd/resolv.conf.virbr1.dhcp ) by /bin/rm[dhcpcd-run-hook:17852] uid/euid:0/0 gid/egid:0/0, parent /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd-run-hook:17847] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n dhcpcd[3570]: virbr1: waiting for carrier Mar 2 17:19:44 g0n kernel: [65471.647074] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --table filter --insert INPUT --in-interface virbr1 --protocol tcp --destination-port 67 --jump ACCEPT ) by /sbin/xtables-multi[libvirtd:17854] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17226] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65471.647733] virbr1: port 1(virbr1-nic) entered blocking state Mar 2 17:19:44 g0n kernel: [65471.647737] virbr1: port 1(virbr1-nic) entered listening state Mar 2 17:19:44 g0n kernel: [65471.648777] grsec: (:::kernel::::S:/) exec of /bin/kmod (/sbin/modprobe -q -- net-pf-16-proto-16-family-nl80211 ) by /bin/kmod[kworker/u8:4:17855] uid/euid:0/0 gid/egid:0/0, parent /[kworker/u8:4:16806] uid/euid:0/0 gid/egid:0/0 Mar 2 17:19:44 g0n kernel: [65471.649624] xt_physdev: using --physdev-out and --physdev-is-out are only supported in the FORWARD and POSTROUTING chains with bridged traffic. Mar 2 17:19:44 g0n kernel: [65471.649629] xt_physdev: using --physdev-out and --physdev-is-out are only supported in the FORWARD and POSTROUTING chains with bridged traffic. Mar 2 17:19:44 g0n kernel: [65471.649633] xt_physdev: using --physdev-out and --physdev-is-out are only supported in the FORWARD and POSTROUTING chains with bridged traffic. Mar 2 17:19:44 g0n kernel: [65471.649636] xt_physdev: using --physdev-out and --physdev-is-out are only supported in the FORWARD and POSTROUTING chains with bridged traffic. Mar 2 17:19:44 g0n kernel: [65471.651858] grsec: (admin:S:/) exec of /sbin/xtables-multi (/sbin/iptables -w --table filter --insert INPUT --in-interface virbr1 --protocol udp --destination-port 67 --jump ACCEPT ) by /sbin/xtables-multi[libvirtd:17856] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17226] uid/euid:0/0 gid/egid:0/0

All the above was just following the user (me, as root) having issued "service libvirtd restart" and "service libvirt-guests restart".

If there are important parts with syslog lines of the libvirt actions missing from above, pls. look up:

Devuan's precursor's, as Tails, image in Qemu (11), part 2
https://www.croatiafidelis.hr/foss/cap/ ... 11.php#No1

Here followed the successful run of Tails in a virtual machine by pure Qemu, about which can be read at:

https://www.croatiafidelis.hr/foss/cap/ ... 11.php#No2

by **timbgo** » Sun Mar 05, 2017 4:10 pm

I first need to improve the script that I used for diffing. Here it is:

Code: Select all: #!/bin/bash # # diffing_script.sh # # Copyright (C) 2015 Miroslav Rovis, <http://www.CroatiaFidelis.hr/> # # released under GPL-3+ or BSD license, user chooses # # in case you name them like: YYMMDD[_something]_[0-9][0-9] # where the "[_something]" is optional, and [0-9][0-9] are consecutive # corresponding to your (monolithic) grsecurity policy chronologically # then # you can give a bash regexp as first arg simple such as: # grsec_17030[0-9]_g0n_[0-9][0-9] # or more complex such as: # .\/ \| grep grsec_17 \| grep \-A3000 grsec_170215_g0n_02\|grep \-v grsec_170.d\| grep \-v grsec_170224_g0n_01_abandoned # # You can look up the topic: # # "Libvirt virtualization policies" # https://forums.grsecurity.net/viewtopic.php?f=5&t=4675 # # to see how this script came to be written # # Some values are hardwired only because I don't have time to work them out. if [ -s "/Cmn/m/B/Virt_170305/grsec_list_CMD.txt" ]; then mv -iv /Cmn/m/B/Virt_170305/grsec_list_CMD.txt \ /Cmn/m/B/Virt_170305/grsec_list_CMD.txt_$(date +%y%m%d_%H%M%S) fi read FAKE > j_TMP j=$(cat j_TMP) echo "give the files to diff" read textfiles_to_diff echo \$textfiles_to_diff: $textfiles_to_diff read FAKE echo -n "ls -1 " > textfiles_to_diff.ls echo $textfiles_to_diff >> textfiles_to_diff.ls read FAKE echo cat textfiles_to_diff.ls cat textfiles_to_diff.ls chmod 755 textfiles_to_diff.ls read FAKE echo ./textfiles_to_diff.ls ./textfiles_to_diff.ls read FAKE ./textfiles_to_diff.ls > textfiles_to_diff.ls-1 read FAKE echo cat textfiles_to_diff.ls-1 cat textfiles_to_diff.ls-1 echo "Is that it?" echo "If those are the files that you want to diff, then go on" read FAKE echo "But if not, pls. Ctrl-C now! And try and fix the script..." read FAKE # the lines of context number is chosen here # see why it's not good too ample context, the best if it just shows, say, # grsecurity policies to which the change belongs. See it in the post that # should just appear after the post: # https://forums.grsecurity.net/viewtopic.php?f=5&t=4675&start=15#p17005 # (of the said topic) echo "Before we loop-diff the files consecutively," echo "you need to provide the right number of lines of" echo "context for the diffing. Give a decimal number, such as:" echo "\"3\", \"10\", \"43\"" read lines_of_context for i in \ $(cat textfiles_to_diff.ls-1) do if [ -e "j_TMP" ]; then echo cat j_TMP; cat j_TMP; j=$(cat j_TMP); echo $j read FAKE echo diff ./$j ./$i if [ ! -d "./${j}" ]; then echo diff ./$j ./$i echo |& tee -a \ /Cmn/m/B/Virt_170305/grsec_list_CMD.txt echo "[b]diff -u${lines_of_context} ./$j ./$i[/b]" |& tee -a \ /Cmn/m/B/Virt_170305/grsec_list_CMD.txt echo |& tee -a \ /Cmn/m/B/Virt_170305/grsec_list_CMD.txt echo "[code]" |& tee -a \ /Cmn/m/B/Virt_170305/grsec_list_CMD.txt read FAKE diff -u${lines_of_context} ./$j ./$i |& tee -a \ /Cmn/m/B/Virt_170305/grsec_list_CMD.txt echo "[/code]" |& tee -a \ /Cmn/m/B/Virt_170305/grsec_list_CMD.txt fi fi echo $i > j_TMP cat j_TMP read FAKE done

I checked, and if I replace, in my original the TAB with 3 spaces, I get the same as what users should get if they select and paste (or some such way) the script from the post of this topic:

Code: Select all: c280900a1f65abedaddeaf14eb184eb42e36bc0c78f6dd48781a35e77ed9b1e9 diffing_script.sh

EDIT 2017-04-02 12:23+02:00:
The above is only with an extra blank char (single space) at end of line 28. Otherwise it is:

Code: Select all: 06aaf8ef7aa37d936788963a24edfe2afec38fba973972939012b41b55b281a2 diffing_script.sh

If selecting (with the click on "Select" js-link or by dragging the mouse, you need to, depending on how well your browser takes the copy) remove blank spaces on the left. There should be none, all lines start with printable chars, excluding spaces, all the way to the start of the for loop.

by **timbgo** » Sun Mar 05, 2017 4:26 pm

I'll now run (from /usr/local/bin where I stowed the script):

Code: Select all: # diffing_script.sh give the files to diff grsec_17030[0-9]_g0n_[0-9][0-9]

...

Code: Select all: If those are the files that you want to diff, then go on But if not, pls. Ctrl-C now! And try and fix the script... Before we loop-diff the files consecutively, you need to provide the right number of lines of context for the diffing. Give a decimal number, such as: "3", "10", "43" 21 cat j_TMP

...

And that got me the code boxes that I'm pasting from here.

diff -u21 ./grsec_170303_g0n_00 ./grsec_170304_g0n_00

Code: Select all: --- ./grsec_170303_g0n_00 2017-03-03 16:57:05.000000000 +0100 +++ ./grsec_170304_g0n_00 2017-03-04 18:53:30.392731048 +0100 @@ -3722,42 +3722,49 @@ /etc/passwd r /proc h /proc/sys/kernel/ngroups_max r /root r /tmp rwcd /usr/sbin/crond rx /usr h /usr/sbin/sendmail x /var h /var/spool/cron rwd -CAP_ALL +CAP_CHOWN +CAP_DAC_OVERRIDE +CAP_SETGID +CAP_SETUID +CAP_SYS_ADMIN bind disabled connect disabled sock_allow_family unix inet # Role: root +subject /usr/sbin/dnsmasq ol + / h + -CAP_ALL + bind disabled + connect disabled + +# Role: root subject /usr/sbin/gpm o / h /dev/input/mice rw /dev h /dev/tty* rw -CAP_ALL +CAP_SYS_ADMIN +CAP_SYS_TTY_CONFIG bind disabled connect disabled # Role: root subject /usr/sbin/libvirtd ol user_transition_allow qemu group_transition_allow kvm libvirt qemu / h -CAP_ALL bind disabled connect disabled # Role: root @@ -4577,42 +4584,44 @@ /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /var/lib/clamav r /var/log/clamav /var/log/clamav/clamd.log a /run/clamav rwcdl -CAP_ALL bind disabled connect disabled role kvm gl user_transition_allow root qemu group_transition_allow root kvm libvirt qemu role libvirt gl user_transition_allow root qemu group_transition_allow root kvm libvirt qemu +role dnsmasq gl + role mysql u #role_allow_ip 0.0.0.0/32 user_transition_allow root group_transition_allow root # Role: mysql subject / / h -CAP_ALL bind disabled connect disabled # Role: mysql subject /usr/sbin/mysqld o user_transition_allow root mysql nobody group_transition_allow root mysql nobody / h /sys/devices/system/cpu/online r /tmp rwcd /usr/sbin/mysqld rx /var/lib/mysql rwcd # /var/lib/mysql/performance_schema @@ -8702,42 +8711,49 @@ /etc h /etc/ld.so.cache r /lib64 rx /lib64/modules h /usr h /usr/bin h /usr/bin/gawk x /usr/bin/tzap x /usr/lib64 h /usr/lib64/gconv/gconv-modules.cache r /usr/lib64/locale/locale-archive r /usr/local h /usr/local/bin/tzap-cat.sh rx /usr/share h /usr/share/locale r -CAP_ALL bind disabled connect disabled sock_allow_family unix inet # Role: miro +subject /usr/sbin/dnsmasq ol + / h + -CAP_ALL + bind disabled + connect disabled + +# Role: miro subject /usr/sbin/libvirtd ol user_transition_allow qemu group_transition_allow kvm libvirt qemu / h -CAP_ALL bind disabled connect disabled # Role: miro subject /usr/sbin/virtlockd ol user_transition_allow qemu group_transition_allow kvm libvirt qemu / h -CAP_ALL bind disabled connect disabled # Role: miro subject /usr/sbin/virtlogd ol user_transition_allow qemu group_transition_allow kvm libvirt qemu

diff -u21 ./grsec_170304_g0n_00 ./grsec_170304_g0n_01

Code: Select all: --- ./grsec_170304_g0n_00 2017-03-04 18:53:30.392731048 +0100 +++ ./grsec_170304_g0n_01 2017-03-04 18:58:40.414731977 +0100 @@ -3725,42 +3725,43 @@ /root r /tmp rwcd /usr/sbin/crond rx /usr h /usr/sbin/sendmail x /var h /var/spool/cron rwd -CAP_ALL +CAP_CHOWN +CAP_DAC_OVERRIDE +CAP_SETGID +CAP_SETUID +CAP_SYS_ADMIN bind disabled connect disabled sock_allow_family unix inet # Role: root subject /usr/sbin/dnsmasq ol / h -CAP_ALL + +CAP_NET_BIND_SERVICE bind disabled connect disabled # Role: root subject /usr/sbin/gpm o / h /dev/input/mice rw /dev h /dev/tty* rw -CAP_ALL +CAP_SYS_ADMIN +CAP_SYS_TTY_CONFIG bind disabled connect disabled # Role: root subject /usr/sbin/libvirtd ol user_transition_allow qemu group_transition_allow kvm libvirt qemu / h -CAP_ALL

diff -u21 ./grsec_170304_g0n_01 ./grsec_170304_g0n_02

Code: Select all: --- ./grsec_170304_g0n_01 2017-03-04 18:58:40.414731977 +0100 +++ ./grsec_170304_g0n_02 2017-03-04 19:07:36.102733583 +0100 @@ -1894,42 +1894,43 @@ +CAP_SYS_TTY_CONFIG bind disabled connect disabled # Role: root subject /sbin/init o / h /bin /bin/login x /dev h /dev/console rw /dev/initctl rw /dev/log rw /run h /run/utmp rw /sbin h /sbin/agetty x /usr /usr/bin /usr/bin/gpg-agent rx /usr/sbin/conntrackd r + /usr/sbin/dnsmasq x /var h /var/log/wtmp w /var/lib/dhcpcd w -CAP_ALL +CAP_MKNOD bind disabled connect disabled # Role: root subject /sbin/installkernel o / h /bin x /boot wc /dev h /dev/tty rw /etc h /etc/ld.so.cache r /lib64 rx /lib64/modules h /proc h /proc/meminfo r

diff -u21 ./grsec_170304_g0n_02 ./grsec_170304_g0n_03

Code: Select all: --- ./grsec_170304_g0n_02 2017-03-04 19:07:36.102733583 +0100 +++ ./grsec_170304_g0n_03 2017-03-04 22:27:42.325769576 +0100 @@ -3233,42 +3233,51 @@ bind disabled connect disabled # Role: root subject /usr/bin/virsh ol user_transition_allow root qemu group_transition_allow root kvm libvirt qemu / h bind disabled connect disabled # Role: root subject /usr/bin/virt-install ol user_transition_allow root qemu group_transition_allow root kvm libvirt qemu / h -CAP_ALL bind disabled connect disabled # Role: root +subject /usr/bin/virt-viewer ol +user_transition_allow root qemu +group_transition_allow root kvm libvirt qemu + / h + -CAP_ALL + bind disabled + connect disabled + +# Role: root subject /usr/bin/wget o / h /dev h /dev/urandom r /etc r /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/passwd h /etc/shadow h /etc/shadow- h /etc/ssh h /etc/ssl h /etc/ssl/certs/ca-certificates.crt r /lib64 rx /lib64/modules h /mnt h /mnt/sde1/distfiles wc /mnt/sde1/snapshots wc /proc /proc/bus h @@ -7769,42 +7778,51 @@ bind disabled connect disabled # Role: miro subject /usr/bin/virsh ol user_transition_allow root qemu group_transition_allow root kvm libvirt qemu / h -CAP_ALL bind disabled connect disabled # Role: miro subject /usr/bin/virt-install ol user_transition_allow root qemu group_transition_allow root kvm libvirt qemu / h -CAP_ALL bind disabled connect disabled +# Role: root +subject /usr/bin/virt-viewer ol +user_transition_allow root qemu +group_transition_allow root kvm libvirt qemu + / h + -CAP_ALL + bind disabled + connect disabled + # Role: miro subject /usr/bin/wget o / h /Cmn rwc /Cmn/dLo rwcdl /dev h /dev/urandom r /etc r /etc/grsec h /etc/gshadow h /etc/gshadow- h /etc/passwd h /etc/shadow h /etc/shadow- h /etc/ssh h /etc/ssl h /etc/ssl/certs/ca-certificates.crt r /home /home/miro rwc /lib64 rx /lib64/modules h @@ -8716,42 +8734,43 @@ /lib64/modules h /usr h /usr/bin h /usr/bin/gawk x /usr/bin/tzap x /usr/lib64 h /usr/lib64/gconv/gconv-modules.cache r /usr/lib64/locale/locale-archive r /usr/local h /usr/local/bin/tzap-cat.sh rx /usr/share h /usr/share/locale r -CAP_ALL bind disabled connect disabled sock_allow_family unix inet # Role: miro subject /usr/sbin/dnsmasq ol / h -CAP_ALL + +CAP_NET_BIND_SERVICE bind disabled connect disabled # Role: miro subject /usr/sbin/libvirtd ol user_transition_allow qemu group_transition_allow kvm libvirt qemu / h -CAP_ALL bind disabled connect disabled # Role: miro subject /usr/sbin/virtlockd ol user_transition_allow qemu group_transition_allow kvm libvirt qemu / h -CAP_ALL bind disabled connect disabled

diff -u21 ./grsec_170304_g0n_03 ./grsec_170304_g0n_04

Code: Select all: --- ./grsec_170304_g0n_03 2017-03-04 22:27:42.325769576 +0100 +++ ./grsec_170304_g0n_04 2017-03-04 22:53:58.281774301 +0100 @@ -3733,42 +3733,43 @@ /proc h /proc/sys/kernel/ngroups_max r /root r /tmp rwcd /usr/sbin/crond rx /usr h /usr/sbin/sendmail x /var h /var/spool/cron rwd -CAP_ALL +CAP_CHOWN +CAP_DAC_OVERRIDE +CAP_SETGID +CAP_SETUID +CAP_SYS_ADMIN bind disabled connect disabled sock_allow_family unix inet # Role: root subject /usr/sbin/dnsmasq ol +group_transition_allow dnsmasq / h -CAP_ALL +CAP_NET_BIND_SERVICE bind disabled connect disabled # Role: root subject /usr/sbin/gpm o / h /dev/input/mice rw /dev h /dev/tty* rw -CAP_ALL +CAP_SYS_ADMIN +CAP_SYS_TTY_CONFIG bind disabled connect disabled # Role: root subject /usr/sbin/libvirtd ol user_transition_allow qemu @@ -8732,42 +8733,43 @@ /etc/ld.so.cache r /lib64 rx /lib64/modules h /usr h /usr/bin h /usr/bin/gawk x /usr/bin/tzap x /usr/lib64 h /usr/lib64/gconv/gconv-modules.cache r /usr/lib64/locale/locale-archive r /usr/local h /usr/local/bin/tzap-cat.sh rx /usr/share h /usr/share/locale r -CAP_ALL bind disabled connect disabled sock_allow_family unix inet # Role: miro subject /usr/sbin/dnsmasq ol +group_transition_allow dnsmasq / h -CAP_ALL +CAP_NET_BIND_SERVICE bind disabled connect disabled # Role: miro subject /usr/sbin/libvirtd ol user_transition_allow qemu group_transition_allow kvm libvirt qemu / h -CAP_ALL bind disabled connect disabled # Role: miro subject /usr/sbin/virtlockd ol user_transition_allow qemu group_transition_allow kvm libvirt qemu / h -CAP_ALL

diff -u21 ./grsec_170304_g0n_04 ./grsec_170304_g0n_05

Code: Select all: --- ./grsec_170304_g0n_04 2017-03-04 22:53:58.281774301 +0100 +++ ./grsec_170304_g0n_05 2017-03-04 23:07:59.504776822 +0100 @@ -3733,43 +3733,43 @@ /proc h /proc/sys/kernel/ngroups_max r /root r /tmp rwcd /usr/sbin/crond rx /usr h /usr/sbin/sendmail x /var h /var/spool/cron rwd -CAP_ALL +CAP_CHOWN +CAP_DAC_OVERRIDE +CAP_SETGID +CAP_SETUID +CAP_SYS_ADMIN bind disabled connect disabled sock_allow_family unix inet # Role: root subject /usr/sbin/dnsmasq ol -group_transition_allow dnsmasq +group_transition_allow nobody dnsmasq / h -CAP_ALL +CAP_NET_BIND_SERVICE bind disabled connect disabled # Role: root subject /usr/sbin/gpm o / h /dev/input/mice rw /dev h /dev/tty* rw -CAP_ALL +CAP_SYS_ADMIN +CAP_SYS_TTY_CONFIG bind disabled connect disabled # Role: root subject /usr/sbin/libvirtd ol user_transition_allow qemu @@ -4597,42 +4597,44 @@ /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /var/lib/clamav r /var/log/clamav /var/log/clamav/clamd.log a /run/clamav rwcdl -CAP_ALL bind disabled connect disabled role kvm gl user_transition_allow root qemu group_transition_allow root kvm libvirt qemu role libvirt gl user_transition_allow root qemu group_transition_allow root kvm libvirt qemu role dnsmasq gl +user_transition_allow nobody dnsmasq +group_transition_allow nobody dnsmasq role mysql u #role_allow_ip 0.0.0.0/32 user_transition_allow root group_transition_allow root # Role: mysql subject / / h -CAP_ALL bind disabled connect disabled # Role: mysql subject /usr/sbin/mysqld o user_transition_allow root mysql nobody group_transition_allow root mysql nobody / h /sys/devices/system/cpu/online r /tmp rwcd /usr/sbin/mysqld rx /var/lib/mysql rwcd @@ -8733,43 +8735,43 @@ /etc/ld.so.cache r /lib64 rx /lib64/modules h /usr h /usr/bin h /usr/bin/gawk x /usr/bin/tzap x /usr/lib64 h /usr/lib64/gconv/gconv-modules.cache r /usr/lib64/locale/locale-archive r /usr/local h /usr/local/bin/tzap-cat.sh rx /usr/share h /usr/share/locale r -CAP_ALL bind disabled connect disabled sock_allow_family unix inet # Role: miro subject /usr/sbin/dnsmasq ol -group_transition_allow dnsmasq +group_transition_allow nobody dnsmasq / h -CAP_ALL +CAP_NET_BIND_SERVICE bind disabled connect disabled # Role: miro subject /usr/sbin/libvirtd ol user_transition_allow qemu group_transition_allow kvm libvirt qemu / h -CAP_ALL bind disabled connect disabled # Role: miro subject /usr/sbin/virtlockd ol user_transition_allow qemu group_transition_allow kvm libvirt qemu / h -CAP_ALL

diff -u21 ./grsec_170304_g0n_05 ./grsec_170304_g0n_06

Code: Select all: --- ./grsec_170304_g0n_05 2017-03-04 23:07:59.504776822 +0100 +++ ./grsec_170304_g0n_06 2017-03-04 23:21:44.396779295 +0100 @@ -3733,42 +3733,43 @@ /proc h /proc/sys/kernel/ngroups_max r /root r /tmp rwcd /usr/sbin/crond rx /usr h /usr/sbin/sendmail x /var h /var/spool/cron rwd -CAP_ALL +CAP_CHOWN +CAP_DAC_OVERRIDE +CAP_SETGID +CAP_SETUID +CAP_SYS_ADMIN bind disabled connect disabled sock_allow_family unix inet # Role: root subject /usr/sbin/dnsmasq ol +user_transition_allow nobody dnsmasq group_transition_allow nobody dnsmasq / h -CAP_ALL +CAP_NET_BIND_SERVICE bind disabled connect disabled # Role: root subject /usr/sbin/gpm o / h /dev/input/mice rw /dev h /dev/tty* rw -CAP_ALL +CAP_SYS_ADMIN +CAP_SYS_TTY_CONFIG bind disabled connect disabled # Role: root subject /usr/sbin/libvirtd ol @@ -8735,42 +8736,43 @@ /etc/ld.so.cache r /lib64 rx /lib64/modules h /usr h /usr/bin h /usr/bin/gawk x /usr/bin/tzap x /usr/lib64 h /usr/lib64/gconv/gconv-modules.cache r /usr/lib64/locale/locale-archive r /usr/local h /usr/local/bin/tzap-cat.sh rx /usr/share h /usr/share/locale r -CAP_ALL bind disabled connect disabled sock_allow_family unix inet # Role: miro subject /usr/sbin/dnsmasq ol +user_transition_allow nobody dnsmasq group_transition_allow nobody dnsmasq / h -CAP_ALL +CAP_NET_BIND_SERVICE bind disabled connect disabled # Role: miro subject /usr/sbin/libvirtd ol user_transition_allow qemu group_transition_allow kvm libvirt qemu / h -CAP_ALL bind disabled connect disabled # Role: miro subject /usr/sbin/virtlockd ol user_transition_allow qemu group_transition_allow kvm libvirt qemu / h

diff -u21 ./grsec_170304_g0n_06 ./grsec_170304_g0n_07

Code: Select all: --- ./grsec_170304_g0n_06 2017-03-04 23:21:44.396779295 +0100 +++ ./grsec_170304_g0n_07 2017-03-04 23:28:18.698780477 +0100 @@ -3733,47 +3733,49 @@ /proc h /proc/sys/kernel/ngroups_max r /root r /tmp rwcd /usr/sbin/crond rx /usr h /usr/sbin/sendmail x /var h /var/spool/cron rwd -CAP_ALL +CAP_CHOWN +CAP_DAC_OVERRIDE +CAP_SETGID +CAP_SETUID +CAP_SYS_ADMIN bind disabled connect disabled sock_allow_family unix inet # Role: root subject /usr/sbin/dnsmasq ol -user_transition_allow nobody dnsmasq -group_transition_allow nobody dnsmasq +user_transition_allow root nobody dnsmasq +group_transition_allow root nobody dnsmasq / h -CAP_ALL + +CAP_NET_ADMIN +CAP_NET_BIND_SERVICE + +CAP_NET_RAW bind disabled connect disabled # Role: root subject /usr/sbin/gpm o / h /dev/input/mice rw /dev h /dev/tty* rw -CAP_ALL +CAP_SYS_ADMIN +CAP_SYS_TTY_CONFIG bind disabled connect disabled # Role: root subject /usr/sbin/libvirtd ol user_transition_allow qemu group_transition_allow kvm libvirt qemu / h -CAP_ALL @@ -4598,44 +4600,44 @@ /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /var/lib/clamav r /var/log/clamav /var/log/clamav/clamd.log a /run/clamav rwcdl -CAP_ALL bind disabled connect disabled role kvm gl user_transition_allow root qemu group_transition_allow root kvm libvirt qemu role libvirt gl user_transition_allow root qemu group_transition_allow root kvm libvirt qemu role dnsmasq gl -user_transition_allow nobody dnsmasq -group_transition_allow nobody dnsmasq +user_transition_allow root nobody dnsmasq +group_transition_allow root nobody dnsmasq role mysql u #role_allow_ip 0.0.0.0/32 user_transition_allow root group_transition_allow root # Role: mysql subject / / h -CAP_ALL bind disabled connect disabled # Role: mysql subject /usr/sbin/mysqld o user_transition_allow root mysql nobody group_transition_allow root mysql nobody / h /sys/devices/system/cpu/online r /tmp rwcd /usr/sbin/mysqld rx /var/lib/mysql rwcd @@ -8736,47 +8738,49 @@ /etc/ld.so.cache r /lib64 rx /lib64/modules h /usr h /usr/bin h /usr/bin/gawk x /usr/bin/tzap x /usr/lib64 h /usr/lib64/gconv/gconv-modules.cache r /usr/lib64/locale/locale-archive r /usr/local h /usr/local/bin/tzap-cat.sh rx /usr/share h /usr/share/locale r -CAP_ALL bind disabled connect disabled sock_allow_family unix inet # Role: miro subject /usr/sbin/dnsmasq ol -user_transition_allow nobody dnsmasq -group_transition_allow nobody dnsmasq +user_transition_allow root nobody dnsmasq +group_transition_allow root nobody dnsmasq / h -CAP_ALL + +CAP_NET_ADMIN +CAP_NET_BIND_SERVICE + +CAP_NET_RAW bind disabled connect disabled # Role: miro subject /usr/sbin/libvirtd ol user_transition_allow qemu group_transition_allow kvm libvirt qemu / h -CAP_ALL bind disabled connect disabled # Role: miro subject /usr/sbin/virtlockd ol user_transition_allow qemu group_transition_allow kvm libvirt qemu / h -CAP_ALL bind disabled connect disabled

diff -u21 ./grsec_170304_g0n_07 ./grsec_170305_g0n_00

Code: Select all: --- ./grsec_170304_g0n_07 2017-03-04 23:28:18.698780477 +0100 +++ ./grsec_170305_g0n_00 2017-03-05 05:40:07.211847356 +0100 @@ -612,44 +612,44 @@ /etc/wgetrc r /lib64 rx /lib64/modules h /usr h /usr/bin h /usr/bin/wget x /usr/lib64 rx /usr/portage wc /var h /var/log/portage_logs /var/log/portage_logs/wget-fetch.log a -CAP_ALL bind disabled connect 192.168.2.0/24:80 stream tcp connect 192.168.3.0/24:80 stream tcp role root uG role_transitions admin shutdown role_allow_ip 192.168.2.0/24 role_allow_ip 192.168.3.0/24 role_allow_ip 0.0.0.0/32 -user_transition_allow apache miro tcpdump qemu -group_transition_allow apache miro tcpdump kvm libvirt qemu +user_transition_allow apache miro tcpdump qemu dnsmasq +group_transition_allow apache miro tcpdump kvm libvirt qemu dnsmasq # Role: root subject / / h /Cmn r /Cmn/Kaff rwxcd /Cmn/MyVideos rwxcd /Cmn/dLo rwxcd /Cmn/gX* rwxcd /Cmn/m* rwxcd /bin rx /sbin rx /dev /dev/grsec h /dev/kmem h /dev/log h /dev/mem h /dev/null rw /dev/port h /dev/tty rw /dev/urandom r /etc rx

diff -u21 ./grsec_170305_g0n_00 ./grsec_170305_g0n_01

Code: Select all: --- ./grsec_170305_g0n_00 2017-03-05 05:40:07.211847356 +0100 +++ ./grsec_170305_g0n_01 2017-03-05 05:43:38.120847988 +0100 @@ -4748,44 +4748,44 @@ /etc/ld.so.cache r /etc/resolv.conf r /lib64 h /lib64/libnss_dns-2.23.so rx /lib64/libresolv-2.23.so rx /lib64/libresolv.so.2 rx /proc r /proc/bus h /proc/kallsyms h /proc/kcore h /proc/modules h /proc/slabinfo h /proc/sys h /usr h /usr/sbin/tcpdump rx -CAP_ALL +CAP_DAC_OVERRIDE bind 0.0.0.0/32:0 dgram ip connect 127.0.0.1/32:53 dgram udp role miro u -user_transition_allow qemu -group_transition_allow kvm libvirt qemu +user_transition_allow qemu dnsmasq +group_transition_allow kvm libvirt qemu dnsmasq role_allow_ip 0.0.0.0/32 # Role: miro subject / / h /Cmn r /Cmn/Kaff rwxcd /Cmn/MyVideos rwxcd /Cmn/dLo rwxcd /Cmn/gX* rwxcd /Cmn/m* rwxcd /Cmn/src* rwxcd /bin rx /boot h /dev /dev/grsec h /dev/kmem h /dev/kvm r /dev/log h /dev/mapper h /dev/mapper/Msy /dev/mem h

diff -u21 ./grsec_170305_g0n_01 ./grsec_170305_g0n_02

Code: Select all: --- ./grsec_170305_g0n_01 2017-03-05 05:43:38.120847988 +0100 +++ ./grsec_170305_g0n_02 2017-03-05 05:50:12.285849169 +0100 @@ -1899,42 +1899,45 @@ subject /sbin/init o / h /bin /bin/login x /dev h /dev/console rw /dev/initctl rw /dev/log rw /run h /run/utmp rw /sbin h /sbin/agetty x /usr /usr/bin /usr/bin/gpg-agent rx /usr/sbin/conntrackd r /usr/sbin/dnsmasq x /var h /var/log/wtmp w /var/lib/dhcpcd w -CAP_ALL + +CAP_NET_BIND_SERVICE + +CAP_NET_ADMIN + +CAP_NET_RAW +CAP_MKNOD bind disabled connect disabled # Role: root subject /sbin/installkernel o / h /bin x /boot wc /dev h /dev/tty rw /etc h /etc/ld.so.cache r /lib64 rx /lib64/modules h /proc h /proc/meminfo r /sbin h /sbin/installkernel r /usr h /usr/lib64/gconv/gconv-modules.cache r

diff -u21 ./grsec_170305_g0n_02 ./grsec_170305_g0n_03

Code: Select all: --- ./grsec_170305_g0n_02 2017-03-05 05:50:12.285849169 +0100 +++ ./grsec_170305_g0n_03 2017-03-05 05:55:10.634850064 +0100 @@ -1879,42 +1879,44 @@ /lib64 rx /lib64/modules h /run rw /sbin h /sbin/agetty x /usr h /usr/lib64/locale/locale-archive r /usr/share/locale r /var h /var/log/wtmp w -CAP_ALL +CAP_CHOWN +CAP_DAC_OVERRIDE +CAP_FSETID +CAP_SYS_ADMIN +CAP_SYS_TTY_CONFIG bind disabled connect disabled # Role: root subject /sbin/init o +user_transition_allow root nobody dnsmasq +group_transition_allow root nobody dnsmasq / h /bin /bin/login x /dev h /dev/console rw /dev/initctl rw /dev/log rw /run h /run/utmp rw /sbin h /sbin/agetty x /usr /usr/bin /usr/bin/gpg-agent rx /usr/sbin/conntrackd r /usr/sbin/dnsmasq x /var h /var/log/wtmp w /var/lib/dhcpcd w -CAP_ALL +CAP_NET_BIND_SERVICE

And next, the problem that i have, because all the above got me results that are confusing to me... I mean not the script, but the virtualization, and for some reason, in its relation to the /usr/sbin/dnsmasq (which I use when my machine functions as local router)...

by **timbgo** » Sun Mar 05, 2017 7:38 pm

The policy is equal to:

grsec_170228_g0n_01

This is the script that I will run:

Code: Select all: #!/bin/sh echo "qemu-img create -f qcow2 gentoo22.img 10G" read FAKE qemu-img create -f qcow2 gentoo22.img 10G exec virt-install \ --connect qemu:///system \ --machine q35 \ --virt-type kvm \ --name gentoo22 \ --disk gentoo22.img \ --memory 512 \ --network network=default \ --graphics vnc \ --cdrom install-amd64-minimal-20170105.iso \ $@

And after consecutive runs, I'll issue, as admin (the root, actually Gradm admin):

Code: Select all: # virsh Welcome to virsh, the virtualisation interactive terminal. Type: 'help' for help with commands 'quit' to quit virsh # shutdown gentoo22 ... virsh # destroy gentoo22 ... virsh # undefine gentoo22 --remove-all-storage --managed-save --snapshots-metadata ...

After which cleanup, I can restart the same procedure with a changed policy. I don't think I should use all the policies from the second previous post, but will skip as many as I can to have a clear change in the syslog to show.

This is currently listed by virsh:

Code: Select all: virsh # list Id Name State ---------------------------------------------------- virsh # list --inactive Id Name State ---------------------------------------------------- - Whonix-Gateway shut off - Whonix-Workstation shut off virsh #

( But I'll try running Whonix later. )

So:

Code: Select all: $ GentooVM22.sh qemu-img create -f qcow2 gentoo22.img 10G Formatting 'gentoo22.img', fmt=qcow2 size=10737418240 encryption=off cluster_size=65536 lazy_refcounts=off refcount_bits=16 WARNING No operating system detected, VM performance may suffer. Specify an OS with --os-variant for optimal results. Starting install... ERROR Unable to open file: /var/log/libvirt/qemu/gentoo22.log: Permission denied Domain installation does not appear to have been successful. If it was, you can restart your domain by running: virsh --connect qemu:///system start gentoo22 otherwise, please restart your installation. $

In the syslog:

cat messages_170305_225920_g0n

Code: Select all: Mar 5 22:58:12 g0n kernel: [344984.405683] grsec: (miro:U:/) exec of /usr/local/bin/GentooVM22.sh (GentooVM22.sh ) by /usr/local/bin/GentooVM22.sh[bash:27401] uid/euid:1000/1000 gid/egid:1000/1000, parent /bin/bash[bash:6458] uid/euid:1000/1000 gid/egid:1000/1000 Mar 5 22:58:13 g0n kernel: [344985.606203] grsec: (miro:U:/) exec of /usr/bin/qemu-img (qemu-img create -f qcow2 gentoo22.img 10G ) by /usr/bin/qemu-img[GentooVM22.sh:27405] uid/euid:1000/1000 gid/egid:1000/1000, parent /usr/local/bin/GentooVM22.sh[GentooVM22.sh:27401] uid/euid:1000/1000 gid/egid:1000/1000 Mar 5 22:58:13 g0n kernel: [344985.708041] grsec: (miro:U:/usr/bin/virt-install) exec of /usr/bin/virt-install (virt-install --connect qemu:///system --machine q35 --virt-type kvm --name gentoo22 --disk gentoo22.img --memory 512 --network n) by /usr/bin/virt-install[GentooVM22.sh:27401] uid/euid:1000/1000 gid/egid:1000/1000, parent /bin/bash[bash:6458] uid/euid:1000/1000 gid/egid:1000/1000 Mar 5 22:58:14 g0n kernel: [344985.715982] grsec: (miro:U:/) exec of /usr/share/virt-manager/virt-install (/usr/share/virt-manager/virt-install --connect qemu:///system --machine q35 --virt-type kvm --name gentoo22 --disk gentoo22.img ) by /usr/share/virt-manager/virt-install[virt-install:27401] uid/euid:1000/1000 gid/egid:1000/1000, parent /bin/bash[bash:6458] uid/euid:1000/1000 gid/egid:1000/1000 Mar 5 22:58:14 g0n kernel: [344985.740752] grsec: (miro:U:/usr/bin/python2.7) exec of /usr/bin/python2.7 (python2.7 /usr/share/virt-manager/virt-install --connect qemu:///system --machine q35 --virt-type kvm --name gentoo22 --disk gen) by /usr/bin/python2.7[virt-install:27401] uid/euid:1000/1000 gid/egid:1000/1000, parent /bin/bash[bash:6458] uid/euid:1000/1000 gid/egid:1000/1000 Mar 5 22:58:14 g0n kernel: [344986.005933] grsec: (miro:U:/sbin/ldconfig) exec of /sbin/ldconfig (/sbin/ldconfig -p ) by /sbin/ldconfig[python2.7:27407] uid/euid:1000/1000 gid/egid:1000/1000, parent /usr/bin/python2.7[python2.7:27401] uid/euid:1000/1000 gid/egid:1000/1000 Mar 5 22:58:15 g0n kernel: [344987.159846] grsec: (miro:U:/) exec of /usr/bin/virt-viewer (virt-viewer --version ) by /usr/bin/virt-viewer[python2.7:27415] uid/euid:1000/1000 gid/egid:1000/1000, parent /usr/bin/python2.7[python2.7:27401] uid/euid:1000/1000 gid/egid:1000/1000 Mar 5 22:58:15 g0n kernel: [344987.421266] grsec: (root:U:/) denied open of /var/log/libvirt/qemu/gentoo22.log for appending by /usr/sbin/virtlogd[virtlogd:4122] uid/euid:0/0 gid/egid:0/0, parent /sbin/init[init:1] uid/euid:0/0 gid/egid:0/0 Mar 5 22:58:15 g0n kernel: [344987.443302] grsec: (root:U:/) denied open of /var/log/libvirt/qemu/gentoo22.log for appending by /usr/sbin/virtlogd[virtlogd:4122] uid/euid:0/0 gid/egid:0/0, parent /sbin/init[init:1] uid/euid:0/0 gid/egid:0/0

---

I forgot to say, but it's still not too late, this is how dnsmasq is installed in Gentoo:

Code: Select all: # cat /etc/group | grep dnsma dnsmasq:x:998: # cat /etc/passwd | grep dnsma dnsmasq:x:115:998:added by portage for dnsmasq:/dev/null:/sbin/nologin #

And this is:

Code: Select all: # cat /etc/dnsmasq.conf | grep -v '^#' | grep -E '[[:print:]]' interface=eth0 #

one of the options that...:

Code: Select all: # bzcat /usr/share/doc/libvirt-3.0.0/README.gentoo.bz2 | grep -A4 dnsm If you are using dnsmasq on your system, you will have to configure /etc/dnsmasq.conf to enable the following settings: bind-interfaces interface or except-interface

...[that] libvirt requires to be set. Unless I'm missing something...

Which I think I'm not...

---

Next:

grsec_170303_g0n_00

Because that one contains lots of changes. If any newbies are reading, I just did:

Code: Select all: # cp -aiv grsec_170303_g0n_00 /etc/grsec/policy cp: overwrite '/etc/grsec/policy'? y 'grsec_170303_g0n_00' -> '/etc/grsec/policy' # diff grsec_170303_g0n_00 /etc/grsec/policy # gradm -D Password: # gradm -L /etc/grsec/learning -E

And this happened:

Code: Select all: $ GentooVM22.sh qemu-img create -f qcow2 gentoo22.img 10G Formatting 'gentoo22.img', fmt=qcow2 size=10737418240 encryption=off cluster_size=65536 lazy_refcounts=off refcount_bits=16 WARNING No operating system detected, VM performance may suffer. Specify an OS with --os-variant for optimal results. Starting install... Creating domain... | 0 B 00:00:00

without the command prompt returning, and I got a small GUI window with
traffic sign direction forbidden, and the inscript in it:
"Unable to connect to libvirt with URI: qemu:///system."

I "OK"ed it to close it.

and the prompt returned after two more lines below:

Code: Select all: Domain installation still in progress. You can reconnect to the console to complete the installation process. $

In the syslog:

cat messages_170306_000524_g0n

Code: Select all: Mar 6 00:04:05 g0n kernel: [348937.501960] grsec: (miro:U:/) exec of /usr/local/bin/GentooVM22.sh (GentooVM22.sh ) by /usr/local/bin/GentooVM22.sh[bash:28217] uid/euid:1000/1000 gid/egid:1000/1000, parent /bin/bash[bash:6458] uid/euid:1000/1000 gid/egid:1000/1000 Mar 6 00:04:08 g0n kernel: [348940.026705] grsec: (miro:U:/) exec of /usr/bin/qemu-img (qemu-img create -f qcow2 gentoo22.img 10G ) by /usr/bin/qemu-img[GentooVM22.sh:28221] uid/euid:1000/1000 gid/egid:1000/1000, parent /usr/local/bin/GentooVM22.sh[GentooVM22.sh:28217] uid/euid:1000/1000 gid/egid:1000/1000 Mar 6 00:04:08 g0n kernel: [348940.093353] grsec: (miro:U:/usr/bin/virt-install) exec of /usr/bin/virt-install (virt-install --connect qemu:///system --machine q35 --virt-type kvm --name gentoo22 --disk gentoo22.img --memory 512 --network n) by /usr/bin/virt-install[GentooVM22.sh:28217] uid/euid:1000/1000 gid/egid:1000/1000, parent /bin/bash[bash:6458] uid/euid:1000/1000 gid/egid:1000/1000 Mar 6 00:04:08 g0n kernel: [348940.101067] grsec: (miro:U:/) exec of /usr/share/virt-manager/virt-install (/usr/share/virt-manager/virt-install --connect qemu:///system --machine q35 --virt-type kvm --name gentoo22 --disk gentoo22.img ) by /usr/share/virt-manager/virt-install[virt-install:28217] uid/euid:1000/1000 gid/egid:1000/1000, parent /bin/bash[bash:6458] uid/euid:1000/1000 gid/egid:1000/1000 Mar 6 00:04:08 g0n kernel: [348940.102575] grsec: (miro:U:/usr/bin/python2.7) exec of /usr/bin/python2.7 (python2.7 /usr/share/virt-manager/virt-install --connect qemu:///system --machine q35 --virt-type kvm --name gentoo22 --disk gen) by /usr/bin/python2.7[virt-install:28217] uid/euid:1000/1000 gid/egid:1000/1000, parent /bin/bash[bash:6458] uid/euid:1000/1000 gid/egid:1000/1000 Mar 6 00:04:08 g0n kernel: [348940.349906] grsec: (miro:U:/sbin/ldconfig) exec of /sbin/ldconfig (/sbin/ldconfig -p ) by /sbin/ldconfig[python2.7:28223] uid/euid:1000/1000 gid/egid:1000/1000, parent /usr/bin/python2.7[python2.7:28217] uid/euid:1000/1000 gid/egid:1000/1000 Mar 6 00:04:09 g0n kernel: [348941.354026] grsec: (miro:U:/) exec of /usr/bin/virt-viewer (virt-viewer --version ) by /usr/bin/virt-viewer[python2.7:28231] uid/euid:1000/1000 gid/egid:1000/1000, parent /usr/bin/python2.7[python2.7:28217] uid/euid:1000/1000 gid/egid:1000/1000 Mar 6 00:04:09 g0n kernel: [348941.579866] grsec: (:::kernel::::S:/) exec of /bin/kmod (/sbin/modprobe -q -- net-pf-16-proto-16-family-nl80211 ) by /bin/kmod[kworker/u8:6:28252] uid/euid:0/0 gid/egid:0/0, parent /[kworker/u8:6:27330] uid/euid:0/0 gid/egid:0/0 Mar 6 00:04:09 g0n kernel: [348941.581297] grsec: (root:U:/) exec of /lib64/udev/net.sh (/lib/udev/net.sh vnet0 start ) by /lib64/udev/net.sh[udevd:28254] uid/euid:0/0 gid/egid:0/0, parent /sbin/udevd[udevd:28253] uid/euid:0/0 gid/egid:0/0 Mar 6 00:04:09 g0n kernel: [348941.595142] grsec: (root:U:/lib64/dhcpcd/dhcpcd-run-hooks) exec of /lib64/dhcpcd/dhcpcd-run-hooks (/lib/dhcpcd/dhcpcd-run-hooks ) by /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd:28256] uid/euid:0/0 gid/egid:0/0, parent /sbin/dhcpcd[dhcpcd:3570] uid/euid:0/0 gid/egid:0/0 Mar 6 00:04:09 g0n kernel: [348941.599349] virbr0: port 2(vnet0) entered blocking state Mar 6 00:04:09 g0n kernel: [348941.599358] virbr0: port 2(vnet0) entered disabled state Mar 6 00:04:09 g0n kernel: [348941.599673] device vnet0 entered promiscuous mode Mar 6 00:04:09 g0n kernel: [348941.606127] grsec: (root:U:/lib64/dhcpcd/dhcpcd-run-hooks) exec of /lib64/dhcpcd/dhcpcd-run-hooks (/lib/dhcpcd/dhcpcd-run-hooks ) by /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd:28257] uid/euid:0/0 gid/egid:0/0, parent /sbin/dhcpcd[dhcpcd:3570] uid/euid:0/0 gid/egid:0/0 Mar 6 00:04:09 g0n kernel: [348941.606328] virbr0: port 2(vnet0) entered blocking state Mar 6 00:04:09 g0n kernel: [348941.606339] virbr0: port 2(vnet0) entered listening state Mar 6 00:04:09 g0n kernel: [348941.616571] grsec: (root:U:/) exec of /usr/bin/cmp (cmp -s /etc/resolv.conf /run/dhcpcd/resolv.conf.vnet0.dhcp ) by /usr/bin/cmp[dhcpcd-run-hook:28259] uid/euid:0/0 gid/egid:0/0, parent /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd-run-hook:28257] uid/euid:0/0 gid/egid:0/0 Mar 6 00:04:09 g0n kernel: [348941.618563] grsec: (root:U:/bin/rm) exec of /bin/rm (rm -f /run/dhcpcd/resolv.conf.vnet0.dhcp ) by /bin/rm[dhcpcd-run-hook:28260] uid/euid:0/0 gid/egid:0/0, parent /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd-run-hook:28257] uid/euid:0/0 gid/egid:0/0 Mar 6 00:04:09 g0n kernel: [348941.622096] grsec: (root:U:/bin/rm) exec of /bin/rm (rm -f /run/dhcpcd/resolv.conf.vnet0.dhcp ) by /bin/rm[dhcpcd-run-hook:28261] uid/euid:0/0 gid/egid:0/0, parent /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd-run-hook:28257] uid/euid:0/0 gid/egid:0/0 Mar 6 00:04:09 g0n dhcpcd[3570]: vnet0: waiting for carrier Mar 6 00:04:09 g0n dhcpcd[3570]: vnet0: carrier acquired Mar 6 00:04:09 g0n kernel: [348941.636876] grsec: (root:U:/lib64/dhcpcd/dhcpcd-run-hooks) exec of /lib64/dhcpcd/dhcpcd-run-hooks (/lib/dhcpcd/dhcpcd-run-hooks ) by /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd:28263] uid/euid:0/0 gid/egid:0/0, parent /sbin/dhcpcd[dhcpcd:3570] uid/euid:0/0 gid/egid:0/0 Mar 6 00:04:09 g0n kernel: [348941.640458] grsec: (root:U:/usr/sbin/libvirtd) chdir to / by /usr/sbin/libvirtd[libvirtd:28264] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17229] uid/euid:0/0 gid/egid:0/0 Mar 6 00:04:09 g0n dhcpcd[3570]: vnet0: IAID 00:b2:ed:88 Mar 6 00:04:09 g0n dhcpcd[3570]: vnet0: adding address fe80::6eca:6c75:5469:e972 Mar 6 00:04:09 g0n kernel: [348941.661995] grsec: (qemu:U:/) exec of /usr/bin/qemu-system-x86_64 (/usr/bin/qemu-system-x86_64 -name guest=gentoo22,debug-threads=on -S -object secret,id=masterKey0,format=raw,file=/var/lib/libvi) by /usr/bin/qemu-system-x86_64[libvirtd:28265] uid/euid:77/77 gid/egid:77/77, parent /sbin/init[init:1] uid/euid:0/0 gid/egid:0/0 Mar 6 00:04:10 g0n qemu-system-x86_64: SQL engine 'mysql' not supported Mar 6 00:04:10 g0n qemu-system-x86_64: auxpropfunc error no mechanism available Mar 6 00:04:10 g0n qemu-system-x86_64: _sasl_plugin_load failed on sasl_auxprop_plug_init for plugin: sql Mar 6 00:04:10 g0n dhcpcd[3570]: vnet0: soliciting an IPv6 router Mar 6 00:04:10 g0n kernel: [348942.068423] grsec: (miro:U:/) exec of /usr/bin/virt-viewer (virt-viewer --connect qemu:///system --wait gentoo22 ) by /usr/bin/virt-viewer[python2.7:28288] uid/euid:1000/1000 gid/egid:1000/1000, parent /usr/bin/python2.7[python2.7:28217] uid/euid:1000/1000 gid/egid:1000/1000 Mar 6 00:04:10 g0n dhcpcd[3570]: vnet0: soliciting a DHCP lease Mar 6 00:04:10 g0n kernel: [348942.148669] grsec: (miro:U:/) denied socket(inet6,dgram,0) by /usr/bin/virt-viewer[virt-viewer:28288] uid/euid:1000/1000 gid/egid:1000/1000, parent /usr/bin/python2.7[python2.7:28217] uid/euid:1000/1000 gid/egid:1000/1000 Mar 6 00:04:10 g0n kernel: [348942.149807] grsec: (miro:U:/) denied connect() to the unix domain socket /run/libvirt/libvirt-sock-ro by /usr/bin/virt-viewer[virt-viewer:28288] uid/euid:1000/1000 gid/egid:1000/1000, parent /usr/bin/python2.7[python2.7:28217] uid/euid:1000/1000 gid/egid:1000/1000 Mar 6 00:04:11 g0n kernel: [348943.635786] virbr0: port 2(vnet0) entered learning state Mar 6 00:04:13 g0n dhcpcd[3570]: virbr0: carrier acquired Mar 6 00:04:13 g0n kernel: [348945.683819] virbr0: port 2(vnet0) entered forwarding state Mar 6 00:04:13 g0n kernel: [348945.683825] virbr0: topology change detected, propagating Mar 6 00:04:13 g0n kernel: [348945.686371] grsec: (root:U:/lib64/dhcpcd/dhcpcd-run-hooks) exec of /lib64/dhcpcd/dhcpcd-run-hooks (/lib/dhcpcd/dhcpcd-run-hooks ) by /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd:28289] uid/euid:0/0 gid/egid:0/0, parent /sbin/dhcpcd[dhcpcd:3570] uid/euid:0/0 gid/egid:0/0 Mar 6 00:04:13 g0n dhcpcd[3570]: virbr0: IAID 00:ea:ee:e9 Mar 6 00:04:13 g0n dhcpcd[3570]: virbr0: IAID conflicts with one assigned to virbr0-nic Mar 6 00:04:13 g0n dhcpcd[3570]: virbr0: soliciting an IPv6 router Mar 6 00:04:14 g0n dhcpcd[3570]: virbr0: soliciting a DHCP lease Mar 6 00:04:15 g0n dhcpcd[3570]: vnet0: probing for an IPv4LL address Mar 6 00:04:19 g0n dhcpcd[3570]: virbr0: probing for an IPv4LL address Mar 6 00:04:20 g0n dhcpcd[3570]: vnet0: using IPv4LL address 169.254.7.131 Mar 6 00:04:20 g0n dhcpcd[3570]: vnet0: adding route to 169.254.0.0/16 Mar 6 00:04:20 g0n dhcpcd[3570]: vnet0: adding default route Mar 6 00:04:20 g0n kernel: [348951.906747] grsec: (root:U:/lib64/dhcpcd/dhcpcd-run-hooks) exec of /lib64/dhcpcd/dhcpcd-run-hooks (/lib/dhcpcd/dhcpcd-run-hooks ) by /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd:28290] uid/euid:0/0 gid/egid:0/0, parent /sbin/dhcpcd[dhcpcd:3570] uid/euid:0/0 gid/egid:0/0 Mar 6 00:04:20 g0n kernel: [348951.918441] grsec: (root:U:/) exec of /usr/bin/cmp (cmp -s /etc/resolv.conf /run/dhcpcd/resolv.conf.vnet0.ipv4ll ) by /usr/bin/cmp[dhcpcd-run-hook:28292] uid/euid:0/0 gid/egid:0/0, parent /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd-run-hook:28290] uid/euid:0/0 gid/egid:0/0 Mar 6 00:04:20 g0n kernel: [348951.922649] grsec: (root:U:/bin/rm) exec of /bin/rm (rm -f /run/dhcpcd/resolv.conf.vnet0.ipv4ll ) by /bin/rm[dhcpcd-run-hook:28293] uid/euid:0/0 gid/egid:0/0, parent /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd-run-hook:28290] uid/euid:0/0 gid/egid:0/0 Mar 6 00:04:20 g0n kernel: [348951.924759] grsec: (root:U:/bin/rm) exec of /bin/rm (rm -f /run/dhcpcd/resolv.conf.vnet0.ipv4ll ) by /bin/rm[dhcpcd-run-hook:28294] uid/euid:0/0 gid/egid:0/0, parent /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd-run-hook:28290] uid/euid:0/0 gid/egid:0/0 Mar 6 00:04:20 g0n kernel: [348951.928544] grsec: (root:U:/bin/hostname) exec of /bin/hostname (hostname ) by /bin/hostname[dhcpcd-run-hook:28296] uid/euid:0/0 gid/egid:0/0, parent /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd-run-hook:28295] uid/euid:0/0 gid/egid:0/0 Mar 6 00:04:23 g0n dhcpcd[3570]: vnet0: no IPv6 Routers available Mar 6 00:04:24 g0n dhcpcd[3570]: virbr0: using IPv4LL address 169.254.64.126 Mar 6 00:04:24 g0n dhcpcd[3570]: virbr0: adding route to 169.254.0.0/16 Mar 6 00:04:24 g0n dhcpcd[3570]: vnet0: deleting default route Mar 6 00:04:24 g0n dnsmasq[17827]: failed to create listening socket for 169.254.64.126: Permission denied Mar 6 00:04:24 g0n dnsmasq[17827]: failed to create listening socket for 169.254.64.126: Permission denied Mar 6 00:04:24 g0n kernel: [348956.150243] grsec: (root:U:/lib64/dhcpcd/dhcpcd-run-hooks) exec of /lib64/dhcpcd/dhcpcd-run-hooks (/lib/dhcpcd/dhcpcd-run-hooks ) by /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd:28301] uid/euid:0/0 gid/egid:0/0, parent /sbin/dhcpcd[dhcpcd:3570] uid/euid:0/0 gid/egid:0/0 Mar 6 00:04:24 g0n kernel: [348956.150261] grsec: (default:D:/) use of CAP_NET_BIND_SERVICE denied for /usr/sbin/dnsmasq[dnsmasq:17827] uid/euid:65534/65534 gid/egid:65534/65534, parent /sbin/init[init:1] uid/euid:0/0 gid/egid:0/0 Mar 6 00:04:24 g0n kernel: [348956.150436] grsec: (default:D:/) use of CAP_NET_BIND_SERVICE denied for /usr/sbin/dnsmasq[dnsmasq:17827] uid/euid:65534/65534 gid/egid:65534/65534, parent /sbin/init[init:1] uid/euid:0/0 gid/egid:0/0 Mar 6 00:04:24 g0n kernel: [348956.165847] grsec: (root:U:/) exec of /usr/bin/cmp (cmp -s /etc/resolv.conf /run/dhcpcd/resolv.conf.virbr0.ipv4ll ) by /usr/bin/cmp[dhcpcd-run-hook:28303] uid/euid:0/0 gid/egid:0/0, parent /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd-run-hook:28301] uid/euid:0/0 gid/egid:0/0 Mar 6 00:04:24 g0n kernel: [348956.169854] grsec: (root:U:/bin/rm) exec of /bin/rm (rm -f /run/dhcpcd/resolv.conf.virbr0.ipv4ll ) by /bin/rm[dhcpcd-run-hook:28304] uid/euid:0/0 gid/egid:0/0, parent /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd-run-hook:28301] uid/euid:0/0 gid/egid:0/0 Mar 6 00:04:24 g0n kernel: [348956.173492] grsec: (root:U:/bin/rm) exec of /bin/rm (rm -f /run/dhcpcd/resolv.conf.virbr0.ipv4ll ) by /bin/rm[dhcpcd-run-hook:28305] uid/euid:0/0 gid/egid:0/0, parent /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd-run-hook:28301] uid/euid:0/0 gid/egid:0/0 Mar 6 00:04:24 g0n kernel: [348956.176874] grsec: (root:U:/bin/hostname) exec of /bin/hostname (hostname ) by /bin/hostname[dhcpcd-run-hook:28307] uid/euid:0/0 gid/egid:0/0, parent /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd-run-hook:28306] uid/euid:0/0 gid/egid:0/0

There, the issue that I wrestled for hours already, and that I couldn't solve yet! See those denied lines above? Let me re-emphasize them:

Code: Select all: Mar 6 00:04:24 g0n dnsmasq[17827]: failed to create listening socket for 169.254.64.126: Permission denied Mar 6 00:04:24 g0n dnsmasq[17827]: failed to create listening socket for 169.254.64.126: Permission denied Mar 6 00:04:24 g0n kernel: [348956.150243] grsec: (root:U:/lib64/dhcpcd/dhcpcd-run-hooks) exec of /lib64/dhcpcd/dhcpcd-run-hooks (/lib/dhcpcd/dhcpcd-run-hooks ) by /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd:28301] uid/euid:0/0 gid/egid:0/0, parent /sbin/dhcpcd[dhcpcd:3570] uid/euid:0/0 gid/egid:0/0 Mar 6 00:04:24 g0n kernel: [348956.150261] grsec: (default:D:/) use of CAP_NET_BIND_SERVICE denied for /usr/sbin/dnsmasq[dnsmasq:17827] uid/euid:65534/65534 gid/egid:65534/65534, parent /sbin/init[init:1] uid/euid:0/0 gid/egid:0/0 Mar 6 00:04:24 g0n kernel: [348956.150436] grsec: (default:D:/) use of CAP_NET_BIND_SERVICE denied for /usr/sbin/dnsmasq[dnsmasq:17827] uid/euid:65534/65534 gid/egid:65534/65534, parent /sbin/init[init:1] uid/euid:0/0 gid/egid:0/0

But maybe I'll find the way in this second try...

BTW, in virsh, there was the shutting, destroying and undefining:

Code: Select all: virsh # shutdown gentoo22 Domain gentoo22 is being shutdown virsh # destroy gentoo22 Domain gentoo22 destroyed virsh # undefine gentoo22 --remove-all-storage --managed-save --snapshots-metadata Domain gentoo22 has been undefined Volume 'sda'(/home/miro/gentoo22.img) removed. virsh #

Also, see the user and group nobody, the gid/egid:65534/65534 ? How am I to deal with those?

But wait, before I try more setting up of learning of groups, subjects, or adding of more objects to subjects, I think I should try and see how this same script fares with GRADM disabled.

That should be next. 20k of text already put together in this post. Let me start the next post with trying that script with RBAC disabled. I bet (because that happened in the first try of this current procedure of this topic) it will just work, and I'll have a working Gentoo VM that browses the internet.

by **timbgo** » Sun Mar 05, 2017 8:51 pm

Here we go. The perfomance is close to impeccable without RBAC enabled. What am I doing wrong?

But let's see. Unfortunately I mixed

I'm always offline before I start my uncenz (https://github.com/miroR/uncenz)

Code: Select all: Mar 6 00:26:44 g0n kernel: [350296.557917] grsec: (miro:U:/) exec of /usr/local/bin/uncenz-1st (uncenz-1st ) by /usr/local/bin/uncenz-1st[bash:28492] uid/euid:1000/1000 gid/egid:1000/1000, parent /bin/bash[bash:23114] uid/euid:1000/1000 gid/egid:1000/1000

It's slowly happening...

Code: Select all: Mar 6 00:26:54 g0n kernel: [350306.447824] sky2 0000:06:00.0 eth1: Link is up at 100 Mbps, full duplex, flow control both Mar 6 00:26:54 g0n kernel: [350306.447870] br0: port 1(eth1) entered blocking state Mar 6 00:26:54 g0n kernel: [350306.447873] br0: port 1(eth1) entered forwarding state Mar 6 00:26:54 g0n dhcpcd[3570]: eth1: carrier acquired Mar 6 00:26:54 g0n kernel: [350306.449226] grsec: (root:U:/lib64/dhcpcd/dhcpcd-run-hooks) exec of /lib64/dhcpcd/dhcpcd-run-hooks (/lib/dhcpcd/dhcpcd-run-hooks ) by /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd:28564] uid/euid:0/0 gid/egid:0/0, parent /sbin/dhcpcd[dhcpcd:3570] uid/euid:0/0 gid/egid:0/0 Mar 6 00:26:54 g0n dhcpcd[3570]: eth1: IAID 2e:ab:28:71 Mar 6 00:26:54 g0n dhcpcd[3570]: eth1: IAID conflicts with one assigned to br0 Mar 6 00:26:54 g0n dhcpcd[3570]: eth1: adding address fe80::30b7:84a9:5f50:6486 Mar 6 00:26:54 g0n dhcpcd[3570]: br0: carrier acquired Mar 6 00:26:54 g0n kernel: [350306.462859] grsec: (root:U:/lib64/dhcpcd/dhcpcd-run-hooks) exec of /lib64/dhcpcd/dhcpcd-run-hooks (/lib/dhcpcd/dhcpcd-run-hooks ) by /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd:28565] uid/euid:0/0 gid/egid:0/0, parent /sbin/dhcpcd[dhcpcd:3570] uid/euid:0/0 gid/egid:0/0 Mar 6 00:26:54 g0n dhcpcd[3570]: br0: IAID 2e:ab:28:71 Mar 6 00:26:54 g0n dhcpcd[3570]: br0: IAID conflicts with one assigned to eth1 Mar 6 00:26:54 g0n dhcpcd[3570]: eth1: deleting address fe80::30b7:84a9:5f50:6486 Mar 6 00:26:54 g0n dhcpcd[3570]: br0: adding address fe80::30b7:84a9:5f50:6486 Mar 6 00:26:54 g0n dhcpcd[3570]: br0: rebinding lease of 192.168.1.4 Mar 6 00:26:55 g0n dhcpcd[3570]: br0: soliciting an IPv6 router Mar 6 00:26:55 g0n dhcpcd[3570]: eth1: soliciting an IPv6 router Mar 6 00:26:55 g0n dhcpcd[3570]: eth1: soliciting a DHCP lease Mar 6 00:26:55 g0n dhcpcd[3570]: br0: Router Advertisement from fe80::1 Mar 6 00:26:55 g0n dhcpcd[3570]: br0: adding default route via fe80::1 Mar 6 00:26:55 g0n kernel: [350307.695392] grsec: (root:U:/lib64/dhcpcd/dhcpcd-run-hooks) exec of /lib64/dhcpcd/dhcpcd-run-hooks (/lib/dhcpcd/dhcpcd-run-hooks ) by /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd:28566] uid/euid:0/0 gid/egid:0/0, parent /sbin/dhcpcd[dhcpcd:3570] uid/euid:0/0 gid/egid:0/0

It gets the addres from the bridge. Pls. see in:
https://github.com/miroR/uncenz/blob/ma ... 2FAKE.ls-1
why in Croatia we can't see our real IPs (search for "Praised be the idiots").

Code: Select all: Mar 6 00:26:58 g0n dhcpcd[3570]: br0: probing address 192.168.1.4/24 Mar 6 00:27:00 g0n dhcpcd[3570]: eth1: probing for an IPv4LL address

However all this is plain host connecting to internet. the guest begins in in 20 more seconds only.

Code: Select all: Mar 6 00:27:03 g0n dhcpcd[3570]: br0: leased 192.168.1.4 for infinity Mar 6 00:27:03 g0n dhcpcd[3570]: br0: adding route to 192.168.1.0/24 Mar 6 00:27:03 g0n dhcpcd[3570]: br0: adding default route via 192.168.1.1 Mar 6 00:27:03 g0n kernel: [350315.500736] grsec: (root:U:/lib64/dhcpcd/dhcpcd-run-hooks) exec of /lib64/dhcpcd/dhcpcd-run-hooks (/lib/dhcpcd/dhcpcd-run-hooks ) by /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd:28600] uid/euid:0/0 gid/egid:0/0, parent /sbin/dhcpcd[dhcpcd:3570] uid/euid:0/0 gid/egid:0/0

These are the OpenNIC (so we're connected, and --relatively, given the beauty of the commie router-- just fine):

Code: Select all: Mar 6 00:27:03 g0n dnsmasq[17827]: reading /etc/resolv.conf Mar 6 00:27:03 g0n dnsmasq[17827]: using nameserver 81.2.237.32#53 Mar 6 00:27:03 g0n dnsmasq[17827]: using nameserver 31.14.133.188#53 Mar 6 00:27:03 g0n dnsmasq[17827]: using nameserver 5.9.49.12#53 Mar 6 00:27:03 g0n dnsmasq[17827]: using nameserver fe80::1%br0#53 Mar 6 00:27:03 g0n kernel: [350315.533138] grsec: (root:U:/bin/rm) exec of /bin/rm (rm -f /run/dhcpcd/resolv.conf.br0.dhcp ) by /bin/rm[dhcpcd-run-hook:28611] uid/euid:0/0 gid/egid:0/0, parent /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd-run-hook:28600] uid/euid:0/0 gid/egid:0/0

temp address taken:

Code: Select all: Mar 6 00:27:03 g0n kernel: [350315.539977] grsec: (root:U:/bin/hostname) exec of /bin/hostname (hostname ) by /bin/hostname[dhcpcd-run-hook:28615] uid/euid:0/0 gid/egid:0/0, parent /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd-run-hook:28614] uid/euid:0/0 gid/egid:0/0 Mar 6 00:27:05 g0n dhcpcd[3570]: eth1: using IPv4LL address 169.254.217.174 Mar 6 00:27:05 g0n dhcpcd[3570]: eth1: adding route to 169.254.0.0/16 Mar 6 00:27:05 g0n kernel: [350317.714429] grsec: (root:U:/lib64/dhcpcd/dhcpcd-run-hooks) exec of /lib64/dhcpcd/dhcpcd-run-hooks (/lib/dhcpcd/dhcpcd-run-hooks ) by /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd:28617] uid/euid:0/0 gid/egid:0/0, parent /sbin/dhcpcd[dhcpcd:3570] uid/euid:0/0 gid/egid:0/0

And here we already know that the guest wouldn't start, at the current stage of my libvirt RBAC policy deployment, unless I :-(

disable RBAC ...

Code: Select all: Mar 6 00:27:05 g0n kernel: [350317.745449] grsec: (root:U:/bin/rm) exec of /bin/rm (rm -f /run/dhcpcd/resolv.conf.eth1.ipv4ll ) by /bin/rm[dhcpcd-run-hook:28628] uid/euid:0/0 gid/egid:0/0, parent /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd-run-hook:28617] uid/euid:0/0 gid/egid:0/0 Mar 6 00:27:05 g0n kernel: [350317.750446] grsec: (root:U:/bin/hostname) exec of /bin/hostname (hostname ) by /bin/hostname[dhcpcd-run-hook:28630] uid/euid:0/0 gid/egid:0/0, parent /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd-run-hook:28629] uid/euid:0/0 gid/egid:0/0 Mar 6 00:27:08 g0n kernel: [350320.517402] mrfw_dropIN=br0 OUT= PHYSIN=eth1 MAC=00:0e:2e:ab:28:71:2c:95:7f:8b:44:87:08:00 SRC=192.168.1.1 DST=255.255.255.255 LEN=576 TOS=0x00 PREC=0x00 TTL=64 ID=0 PROTO=UDP SPT=67 DPT=68 LEN=556 Mar 6 00:27:10 g0n kernel: [350322.195238] grsec: (root:U:/sbin/gradm) exec of /sbin/gradm (gradm -D ) by /sbin/gradm[bash:28632] uid/euid:0/0 gid/egid:0/0, parent /bin/bash[bash:4692] uid/euid:0/0 gid/egid:0/0 Mar 6 00:27:15 g0n kernel: [350327.074491] grsec: (root:U:/sbin/gradm) shutdown auth failure for /sbin/gradm[gradm:28632] uid/euid:0/0 gid/egid:0/0, parent /bin/bash[bash:4692] uid/euid:0/0 gid/egid:0/0 Mar 6 00:27:16 g0n kernel: [350328.327806] grsec: (root:U:/sbin/gradm) exec of /sbin/gradm (gradm -D ) by /sbin/gradm[bash:28633] uid/euid:0/0 gid/egid:0/0, parent /bin/bash[bash:4692] uid/euid:0/0 gid/egid:0/0 Mar 6 00:27:20 g0n kernel: [350332.736721] grsec: shutdown auth success for /sbin/gradm[gradm:28633] uid/euid:0/0 gid/egid:0/0, parent /bin/bash[bash:4692] uid/euid:0/0 gid/egid:0/0 Mar 6 00:27:20 g0n kernel: [350332.737109] grsec: exec of /sbin/grlearn (/sbin/grlearn -stop ) by /sbin/grlearn[gradm:28634] uid/euid:0/0 gid/egid:0/0, parent /sbin/init[init:1] uid/euid:0/0 gid/egid:0/0 Mar 6 00:27:24 g0n kernel: [350336.137102] mrfw_dropIN=br0 OUT= PHYSIN=eth1 MAC=00:0e:2e:ab:28:71:2c:95:7f:8b:44:87:08:00 SRC=192.168.1.1 DST=255.255.255.255 LEN=576 TOS=0x00 PREC=0x00 TTL=64 ID=0 PROTO=UDP SPT=67 DPT=68 LEN=556 Mar 6 00:27:26 g0n kernel: [350338.068888] grsec: exec of /usr/local/bin/GentooVM22.sh (GentooVM22.sh ) by /usr/local/bin/GentooVM22.sh[bash:28638] uid/euid:1000/1000 gid/egid:1000/1000, parent /bin/bash[bash:6458] uid/euid:1000/1000 gid/egid:1000/1000 Mar 6 00:27:28 g0n kernel: [350340.331323] grsec: exec of /usr/bin/qemu-img (qemu-img create -f qcow2 gentoo22.img 10G ) by /usr/bin/qemu-img[GentooVM22.sh:28639] uid/euid:1000/1000 gid/egid:1000/1000, parent /usr/local/bin/GentooVM22.sh[GentooVM22.sh:28638] uid/euid:1000/1000 gid/egid:1000/1000 Mar 6 00:27:28 g0n kernel: [350340.411326] grsec: exec of /usr/bin/virt-install (virt-install --connect qemu:///system --machine q35 --virt-type kvm --name gentoo22 --disk gentoo22.img --memory 512 --network n) by /usr/bin/virt-install[GentooVM22.sh:28638] uid/euid:1000/1000 gid/egid:1000/1000, parent /bin/bash[bash:6458] uid/euid:1000/1000 gid/egid:1000/1000 Mar 6 00:27:28 g0n kernel: [350340.414120] grsec: exec of /usr/share/virt-manager/virt-install (/usr/share/virt-manager/virt-install --connect qemu:///system --machine q35 --virt-type kvm --name gentoo22 --disk gentoo22.img ) by /usr/share/virt-manager/virt-install[virt-install:28638] uid/euid:1000/1000 gid/egid:1000/1000, parent /bin/bash[bash:6458] uid/euid:1000/1000 gid/egid:1000/1000 Mar 6 00:27:28 g0n kernel: [350340.417031] grsec: exec of /usr/bin/python2.7 (python2.7 /usr/share/virt-manager/virt-install --connect qemu:///system --machine q35 --virt-type kvm --name gentoo22 --disk gen) by /usr/bin/python2.7[virt-install:28638] uid/euid:1000/1000 gid/egid:1000/1000, parent /bin/bash[bash:6458] uid/euid:1000/1000 gid/egid:1000/1000

These are not (yet) issues with the hardware. It's what I get when I visit somewhere Schmoogle the Schmoog. I downloaded some (not even large) video from Schmootube, and pronto I had these issues.

Probably not dangerous because upon cloning from Air-Gap these issues never are back.

( And this is where the libvirt starts to connect. )

These with the "rx error" (only one just under here, and a few later on, most cut with other huge swathes of syslog; who would read it else?):

Code: Select all: Mar 6 00:27:28 g0n kernel: [350340.661077] sky2 0000:06:00.0 eth1: rx error, status 0x5d0100 length 93 Mar 6 00:27:28 g0n kernel: [350340.667716] grsec: exec of /sbin/ldconfig (/sbin/ldconfig -p ) by /sbin/ldconfig[python2.7:28641] uid/euid:1000/1000 gid/egid:1000/1000, parent /usr/bin/python2.7[python2.7:28638] uid/euid:1000/1000 gid/egid:1000/1000 Mar 6 00:27:29 g0n kernel: [350341.689710] grsec: exec of /usr/bin/virt-viewer (virt-viewer --version ) by /usr/bin/virt-viewer[python2.7:28649] uid/euid:1000/1000 gid/egid:1000/1000, parent /usr/bin/python2.7[python2.7:28638] uid/euid:1000/1000 gid/egid:1000/1000 Mar 6 00:27:30 g0n kernel: [350341.908678] grsec: exec of /bin/kmod (/sbin/modprobe -q -- net-pf-16-proto-16-family-nl80211 ) by /bin/kmod[kworker/u8:0:28671] uid/euid:0/0 gid/egid:0/0, parent /[kworker/u8:0:28325] uid/euid:0/0 gid/egid:0/0 Mar 6 00:27:30 g0n kernel: [350341.909151] grsec: exec of /lib64/udev/net.sh (/lib/udev/net.sh vnet0 start ) by /lib64/udev/net.sh[udevd:28672] uid/euid:0/0 gid/egid:0/0, parent /sbin/udevd[udevd:28670] uid/euid:0/0 gid/egid:0/0 Mar 6 00:27:30 g0n kernel: [350341.916668] grsec: exec of /lib64/dhcpcd/dhcpcd-run-hooks (/lib/dhcpcd/dhcpcd-run-hooks ) by /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd:28674] uid/euid:0/0 gid/egid:0/0, parent /sbin/dhcpcd[dhcpcd:3570] uid/euid:0/0 gid/egid:0/0 Mar 6 00:27:30 g0n kernel: [350341.925244] grsec: exec of /lib64/dhcpcd/dhcpcd-run-hooks (/lib/dhcpcd/dhcpcd-run-hooks ) by /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd:28675] uid/euid:0/0 gid/egid:0/0, parent /sbin/dhcpcd[dhcpcd:3570] uid/euid:0/0 gid/egid:0/0 Mar 6 00:27:30 g0n kernel: [350341.931185] virbr0: port 2(vnet0) entered blocking state Mar 6 00:27:30 g0n kernel: [350341.931189] virbr0: port 2(vnet0) entered disabled state Mar 6 00:27:30 g0n kernel: [350341.931319] device vnet0 entered promiscuous mode Mar 6 00:27:30 g0n kernel: [350341.932873] grsec: chdir to /run/dhcpcd/resolv.conf by /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd-run-hook:28677] uid/euid:0/0 gid/egid:0/0, parent /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd-run-hook:28675] uid/euid:0/0 gid/egid:0/0

These ".ra" must be from the radvd (router advertizing "daemon"). Why don't I see them when I enable RBAC?

Code: Select all: Mar 6 00:27:30 g0n kernel: [350341.933519] grsec: exec of /bin/sed (sed -n s/^domain //p br0.dhcp br0.dhcp6 br0.ra ) by /bin/sed[dhcpcd-run-hook:28678] uid/euid:0/0 gid/egid:0/0, parent /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd-run-hook:28677] uid/euid:0/0 gid/egid:0/0 Mar 6 00:27:30 g0n kernel: [350341.935836] grsec: chdir to /run/dhcpcd/resolv.conf by /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd-run-hook:28679] uid/euid:0/0 gid/egid:0/0, parent /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd-run-hook:28675] uid/euid:0/0 gid/egid:0/0 Mar 6 00:27:30 g0n kernel: [350341.936228] virbr0: port 2(vnet0) entered blocking state Mar 6 00:27:30 g0n kernel: [350341.936231] virbr0: port 2(vnet0) entered listening state Mar 6 00:27:30 g0n kernel: [350341.936632] grsec: exec of /bin/sed (sed -n s/^search //p br0.dhcp br0.dhcp6 br0.ra ) by /bin/sed[dhcpcd-run-hook:28680] uid/euid:0/0 gid/egid:0/0, parent /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd-run-hook:28679] uid/euid:0/0 gid/egid:0/0 Mar 6 00:27:30 g0n kernel: [350341.938887] grsec: chdir to /run/dhcpcd/resolv.conf by /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd-run-hook:28681] uid/euid:0/0 gid/egid:0/0, parent /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd-run-hook:28675] uid/euid:0/0 gid/egid:0/0 Mar 6 00:27:30 g0n kernel: [350341.939557] grsec: exec of /bin/sed (sed -n s/^nameserver //p br0.dhcp br0.dhcp6 br0.ra ) by /bin/sed[dhcpcd-run-hook:28682] uid/euid:0/0 gid/egid:0/0, parent /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd-run-hook:28681] uid/euid:0/0 gid/egid:0/0 Mar 6 00:27:30 g0n kernel: [350341.944050] grsec: exec of /usr/bin/cmp (cmp -s /etc/resolv.conf /run/dhcpcd/resolv.conf.vnet0.dhcp ) by /usr/bin/cmp[dhcpcd-run-hook:28684] uid/euid:0/0 gid/egid:0/0, parent /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd-run-hook:28675] uid/euid:0/0 gid/egid:0/0 Mar 6 00:27:30 g0n kernel: [350341.945696] grsec: exec of /bin/rm (rm -f /run/dhcpcd/resolv.conf.vnet0.dhcp ) by /bin/rm[dhcpcd-run-hook:28685] uid/euid:0/0 gid/egid:0/0, parent /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd-run-hook:28675] uid/euid:0/0 gid/egid:0/0 Mar 6 00:27:30 g0n kernel: [350341.947003] grsec: exec of /bin/rm (rm -f /run/dhcpcd/resolv.conf.vnet0.dhcp ) by /bin/rm[dhcpcd-run-hook:28686] uid/euid:0/0 gid/egid:0/0, parent /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd-run-hook:28675] uid/euid:0/0 gid/egid:0/0 Mar 6 00:27:30 g0n kernel: [350341.953792] grsec: chdir to / by /usr/sbin/libvirtd[libvirtd:28688] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/libvirtd[libvirtd:17226] uid/euid:0/0 gid/egid:0/0 Mar 6 00:27:30 g0n dhcpcd[3570]: vnet0: waiting for carrier Mar 6 00:27:30 g0n dhcpcd[3570]: vnet0: carrier acquired Mar 6 00:27:30 g0n kernel: [350341.957194] grsec: exec of /lib64/dhcpcd/dhcpcd-run-hooks (/lib/dhcpcd/dhcpcd-run-hooks ) by /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd:28690] uid/euid:0/0 gid/egid:0/0, parent /sbin/dhcpcd[dhcpcd:3570] uid/euid:0/0 gid/egid:0/0 Mar 6 00:27:30 g0n dhcpcd[3570]: vnet0: IAID 00:c3:bf:87 Mar 6 00:27:30 g0n dhcpcd[3570]: vnet0: adding address fe80::11e8:7181:f97a:b0e3 Mar 6 00:27:30 g0n kernel: [350341.971133] grsec: exec of /usr/bin/qemu-system-x86_64 (/usr/bin/qemu-system-x86_64 -name guest=gentoo22,debug-threads=on -S -object secret,id=masterKey0,format=raw,file=/var/lib/libvi) by /usr/bin/qemu-system-x86_64[libvirtd:28689] uid/euid:77/77 gid/egid:77/77, parent /sbin/init[init:1] uid/euid:0/0 gid/egid:0/0 Mar 6 00:27:30 g0n qemu-system-x86_64: SQL engine 'mysql' not supported Mar 6 00:27:30 g0n qemu-system-x86_64: auxpropfunc error no mechanism available Mar 6 00:27:30 g0n qemu-system-x86_64: _sasl_plugin_load failed on sasl_auxprop_plug_init for plugin: sql Mar 6 00:27:30 g0n dhcpcd[3570]: vnet0: soliciting an IPv6 router Mar 6 00:27:30 g0n kernel: [350342.327983] grsec: exec of /usr/bin/virt-viewer (virt-viewer --connect qemu:///system --wait gentoo22 ) by /usr/bin/virt-viewer[python2.7:28713] uid/euid:1000/1000 gid/egid:1000/1000, parent /usr/bin/python2.7[python2.7:28638] uid/euid:1000/1000 gid/egid:1000/1000 Mar 6 00:27:30 g0n kernel: [350342.402568] grsec: exec of /bin/bash (sh -c "/usr/bin/xkbcomp" -w 1 "-R/usr/share/X11/xkb" -xkm "-" -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " ) by /bin/bash[X:28714] uid/euid:1000/1000 gid/egid:1000/1000, parent /usr/bin/Xorg[X:23021] uid/euid:1000/0 gid/egid:1000/1000 Mar 6 00:27:30 g0n kernel: [350342.410614] grsec: exec of /usr/bin/xkbcomp (/usr/bin/xkbcomp -w 1 -R/usr/share/X11/xkb -xkm - -em1 The XKEYBOARD keymap compiler (xkbcomp) reports: -emp > -eml Errors from) by /usr/bin/xkbcomp[sh:28714] uid/euid:1000/1000 gid/egid:1000/1000, parent /usr/bin/Xorg[X:23021] uid/euid:1000/0 gid/egid:1000/1000 Mar 6 00:27:30 g0n kernel: [350342.420753] grsec: chdir to /usr/share/X11/xkb by /usr/bin/xkbcomp[xkbcomp:28714] uid/euid:1000/1000 gid/egid:1000/1000, parent /usr/bin/Xorg[X:23021] uid/euid:1000/0 gid/egid:1000/1000 Mar 6 00:27:30 g0n dhcpcd[3570]: vnet0: soliciting a DHCP lease Mar 6 00:27:31 g0n kernel: [350343.562820] kvm: zapping shadow pages for mmio generation wraparound Mar 6 00:27:32 g0n kernel: [350343.980118] virbr0: port 2(vnet0) entered learning state Mar 6 00:27:32 g0n kernel: [350344.499317] kvm [28689]: vcpu0, guest rIP: 0xffffffff8103a831 unhandled rdmsr: 0xc0010048 Mar 6 00:27:32 g0n kernel: [350344.680881] kvm: zapping shadow pages for mmio generation wraparound Mar 6 00:27:34 g0n kernel: [350346.028214] virbr0: port 2(vnet0) entered forwarding state Mar 6 00:27:34 g0n kernel: [350346.028254] virbr0: topology change detected, propagating Mar 6 00:27:34 g0n dhcpcd[3570]: virbr0: carrier acquired Mar 6 00:27:34 g0n kernel: [350346.031210] grsec: exec of /lib64/dhcpcd/dhcpcd-run-hooks (/lib/dhcpcd/dhcpcd-run-hooks ) by /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd:28716] uid/euid:0/0 gid/egid:0/0, parent /sbin/dhcpcd[dhcpcd:3570] uid/euid:0/0 gid/egid:0/0 Mar 6 00:27:34 g0n dhcpcd[3570]: virbr0: IAID 00:ea:ee:e9 Mar 6 00:27:34 g0n dhcpcd[3570]: virbr0: IAID conflicts with one assigned to virbr0-nic Mar 6 00:27:34 g0n dhcpcd[3570]: virbr0: soliciting a DHCP lease Mar 6 00:27:35 g0n dhcpcd[3570]: virbr0: soliciting an IPv6 router Mar 6 00:27:35 g0n dhcpcd[3570]: vnet0: probing for an IPv4LL address Mar 6 00:27:39 g0n dhcpcd[3570]: virbr0: probing for an IPv4LL address Mar 6 00:27:40 g0n dhcpcd[3570]: vnet0: using IPv4LL address 169.254.17.218 Mar 6 00:27:40 g0n dhcpcd[3570]: vnet0: adding route to 169.254.0.0/16

Connecting...

Code: Select all: Mar 6 00:27:43 g0n dhcpcd[3570]: vnet0: no IPv6 Routers available Mar 6 00:27:44 g0n dhcpcd[3570]: virbr0: using IPv4LL address 169.254.64.126 Mar 6 00:27:44 g0n dhcpcd[3570]: virbr0: adding route to 169.254.0.0/16

Connecting...

Code: Select all: Mar 6 00:27:55 g0n kernel: [350367.176360] mrfw_dropIN=br0 OUT= PHYSIN=eth1 MAC=00:0e:2e:ab:28:71:2c:95:7f:8b:44:87:08:00 SRC=192.168.1.1 DST=255.255.255.255 LEN=576 TOS=0x00 PREC=0x00 TTL=64 ID=0 PROTO=UDP SPT=67 DPT=68 LEN=556 Mar 6 00:27:55 g0n kernel: [350367.695954] mrfw_pingIN= OUT=virbr0 SRC=192.168.122.1 DST=192.168.122.34 LEN=48 TOS=0x00 PREC=0x00 TTL=64 ID=63528 DF PROTO=ICMP TYPE=8 CODE=0 ID=57468 SEQ=0 Mar 6 00:27:58 g0n dnsmasq-dhcp[17827]: DHCPDISCOVER(virbr0) 52:54:00:c3:bf:87 Mar 6 00:27:58 g0n dnsmasq-dhcp[17827]: DHCPOFFER(virbr0) 192.168.122.34 52:54:00:c3:bf:87 Mar 6 00:27:58 g0n dnsmasq-dhcp[17827]: DHCPREQUEST(virbr0) 192.168.122.34 52:54:00:c3:bf:87 Mar 6 00:27:58 g0n dnsmasq-dhcp[17827]: DHCPACK(virbr0) 192.168.122.34 52:54:00:c3:bf:87 livecd

Look, the libvirt_leaseshelper at work. And I looked up the screencast (will probably post it to, where?, to:
( haven't decided on the title yet )
https://www.croatiafidelis.hr/foss/cap/ ... uan-12.php (NOTE: inexistent at the time of posting this)
It's here that I, in Gentoo guest VM, with links browser, connected to http://www.devuan.org. These three lines were in the log in bottom of the screen:

Code: Select all: Mar 6 00:27:58 g0n kernel: [350369.951509] grsec: exec of /usr/libexec/libvirt_leaseshelper (libvirt_leaseshelper add 52:54:00:c3:bf:87 192.168.122.34 livecd ) by /usr/libexec/libvirt_leaseshelper[dnsmasq:28748] uid/euid:0/0 gid/egid:0/0, parent /usr/sbin/dnsmasq[dnsmasq:17828] uid/euid:0/0 gid/egid:0/0 Mar 6 00:28:08 g0n kernel: [350380.043690] mrfw_dropIN=br0 OUT= PHYSIN=eth1 MAC=01:00:5e:00:00:01:24:9e:ab:c9:3d:77:08:00 SRC=192.168.1.1 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0x00 TTL=1 ID=37270 PROTO=2 Mar 6 00:28:19 g0n kernel: [350391.370209] sky2 0000:06:00.0 eth1: rx error, status 0x420100 length 66

And this line, 25 seconds later, is when I unplugged the cord to the commie router.

Code: Select all: Mar 6 00:28:44 g0n dhcpcd[3570]: vnet0: carrier lost

So the rest below probably doesn't matter so much.

Code: Select all: Mar 6 00:28:44 g0n dhcpcd[3570]: vnet0: removing interface Mar 6 00:28:44 g0n kernel: [350416.297372] grsec: exec of /bin/kmod (/sbin/modprobe -q -- netdev-vnet0 ) by /bin/kmod[kworker/u8:1:28809] uid/euid:0/0 gid/egid:0/0, parent /[kworker/u8:1:27374] uid/euid:0/0 gid/egid:0/0 Mar 6 00:28:44 g0n kernel: [350416.299067] grsec: exec of /bin/kmod (/sbin/modprobe -q -- vnet0 grsec_modharden_netdev ) by /bin/kmod[kworker/u8:1:28810] uid/euid:0/0 gid/egid:0/0, parent /[kworker/u8:1:27374] uid/euid:0/0 gid/egid:0/0 Mar 6 00:28:44 g0n kernel: [350416.302661] grsec: exec of /lib64/dhcpcd/dhcpcd-run-hooks (/lib/dhcpcd/dhcpcd-run-hooks ) by /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd:28811] uid/euid:0/0 gid/egid:0/0, parent /sbin/dhcpcd[dhcpcd:3570] uid/euid:0/0 gid/egid:0/0

...

Code: Select all: Mar 6 00:28:44 g0n kernel: [350416.793037] virbr0: port 2(vnet0) entered blocking state Mar 6 00:28:44 g0n kernel: [350416.793043] virbr0: port 2(vnet0) entered disabled state Mar 6 00:28:44 g0n kernel: [350416.793196] device vnet0 entered promiscuous mode Mar 6 00:28:44 g0n kernel: [350416.801609] virbr0: port 2(vnet0) entered blocking state Mar 6 00:28:44 g0n kernel: [350416.801615] virbr0: port 2(vnet0) entered listening state Mar 6 00:28:45 g0n kernel: [350416.805882] grsec: chdir to /run/dhcpcd/resolv.conf by /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd-run-hook:28910] uid/euid:0/0 gid/egid:0/0, parent /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd-run-hook:28908] uid/euid:0/0 gid/egid:0/0

...

Code: Select all: Mar 6 00:28:45 g0n kernel: [350416.826188] grsec: exec of /usr/bin/qemu-system-x86_64 (/usr/bin/qemu-system-x86_64 -name guest=gentoo22,debug-threads=on -S -object secret,id=masterKey0,format=raw,file=/var/lib/libvi) by /usr/bin/qemu-system-x86_64[libvirtd:28919] uid/euid:77/77 gid/egid:77/77, parent /sbin/init[init:1] uid/euid:0/0 gid/egid:0/0 Mar 6 00:28:45 g0n kernel: [350416.829085] grsec: exec of /bin/rm (rm -f /run/dhcpcd/resolv.conf.vnet0.dhcp ) by /bin/rm[dhcpcd-run-hook:28921] uid/euid:0/0 gid/egid:0/0, parent /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd-run-hook:28908] uid/euid:0/0 gid/egid:0/0 Mar 6 00:28:45 g0n dhcpcd[3570]: vnet0: waiting for carrier Mar 6 00:28:45 g0n dhcpcd[3570]: vnet0: new hardware address: fe:54:00:c3:bf:87 Mar 6 00:28:45 g0n dhcpcd[3570]: vnet0: carrier acquired Mar 6 00:28:45 g0n kernel: [350416.836470] grsec: exec of /lib64/dhcpcd/dhcpcd-run-hooks (/lib/dhcpcd/dhcpcd-run-hooks ) by /lib64/dhcpcd/dhcpcd-run-hooks[dhcpcd:28923] uid/euid:0/0 gid/egid:0/0, parent /sbin/dhcpcd[dhcpcd:3570] uid/euid:0/0 gid/egid:0/0 Mar 6 00:28:45 g0n dhcpcd[3570]: vnet0: IAID 00:c3:bf:87 Mar 6 00:28:45 g0n dhcpcd[3570]: vnet0: adding address fe80::11e8:7181:f97a:b0e3 Mar 6 00:28:45 g0n qemu-system-x86_64: SQL engine 'mysql' not supported Mar 6 00:28:45 g0n qemu-system-x86_64: auxpropfunc error no mechanism available Mar 6 00:28:45 g0n qemu-system-x86_64: _sasl_plugin_load failed on sasl_auxprop_plug_init for plugin: sql Mar 6 00:28:45 g0n kernel: [350417.062615] grsec: exec of /usr/bin/virt-viewer (virt-viewer --connect qemu:///system --wait gentoo22 ) by /usr/bin/virt-viewer[python2.7:28929] uid/euid:1000/1000 gid/egid:1000/1000, parent /usr/bin/python2.7[python2.7:28638] uid/euid:1000/1000 gid/egid:1000/1000 Mar 6 00:28:45 g0n kernel: [350417.160303] grsec: exec of /bin/bash (sh -c "/usr/bin/xkbcomp" -w 1 "-R/usr/share/X11/xkb" -xkm "-" -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " ) by /bin/bash[X:28930] uid/euid:1000/1000 gid/egid:1000/1000, parent /usr/bin/Xorg[X:23021] uid/euid:1000/0 gid/egid:1000/1000 Mar 6 00:28:45 g0n kernel: [350417.169324] grsec: exec of /usr/bin/xkbcomp (/usr/bin/xkbcomp -w 1 -R/usr/share/X11/xkb -xkm - -em1 The XKEYBOARD keymap compiler (xkbcomp) reports: -emp > -eml Errors from) by /usr/bin/xkbcomp[sh:28930] uid/euid:1000/1000 gid/egid:1000/1000, parent /usr/bin/Xorg[X:23021] uid/euid:1000/0 gid/egid:1000/1000 Mar 6 00:28:45 g0n kernel: [350417.171046] grsec: chdir to /usr/share/X11/xkb by /usr/bin/xkbcomp[xkbcomp:28930] uid/euid:1000/1000 gid/egid:1000/1000, parent /usr/bin/Xorg[X:23021] uid/euid:1000/0 gid/egid:1000/1000 Mar 6 00:28:45 g0n dhcpcd[3570]: vnet0: soliciting a DHCP lease Mar 6 00:28:45 g0n dhcpcd[3570]: vnet0: soliciting an IPv6 router Mar 6 00:28:47 g0n kernel: [350418.861429] virbr0: port 2(vnet0) entered learning state Mar 6 00:28:47 g0n kernel: [350419.151608] sky2 0000:06:00.0 eth1: Link is down Mar 6 00:28:47 g0n dhcpcd[3570]: eth1: carrier lost Mar 6 00:28:47 g0n kernel: [350419.153072] br0: port 1(eth1) entered disabled state

Code: Select all: ... Mar 6 00:28:48 g0n dhcpcd[3570]: br0: deleting address fe80::30b7:84a9:5f50:6486 Mar 6 00:28:48 g0n dhcpcd[3570]: br0: deleting default route via 192.168.1.1 Mar 6 00:28:48 g0n dhcpcd[3570]: br0: deleting route to 192.168.1.0/24

This is also seen on the screen (I'll post the trace and the screencast tomorrow)...

Code: Select all: Mar 6 00:28:52 g0n kernel: [350424.745858] grsec: exec of /usr/local/bin/uncenz-kill (uncenz-kill ) by /usr/local/bin/uncenz-kill[bash:29021] uid/euid:1000/1000 gid/egid:1000/1000, parent /bin/bash[bash:23114] uid/euid:1000/1000 gid/egid:1000/1000

Conclusion: otherwise, I would think I have correctly configured libivirt, dnsmasq, qemu and other necessary programs for these things. But getting RBAC to work with these, I have not yet succeeded.

Regards!
EDIT 2017-04-02 12:22+02:00: s/OpenDNS/OpenNIC/ It's OpenNIC, they inspire to me the most confidence. I simply used wrong name, by mistake. I've been useing OpenNIC for maybe a year now.

grsecurity forums

Libvirt virtualization policies

Re: Libvirt virtualization policies

Re: Libvirt virtualization policies

Re: Libvirt virtualization policies

Re: Libvirt virtualization policies

Re: Libvirt virtualization policies

Re: Libvirt virtualization policies

Re: Libvirt virtualization policies

Re: Libvirt virtualization policies

Re: Libvirt virtualization policies

Re: Libvirt virtualization policies

Re: Libvirt virtualization policies

Re: Libvirt virtualization policies

Re: Libvirt virtualization policies

Re: Libvirt virtualization policies

Re: Libvirt virtualization policies