ACL Configuration and Specification

-With all the above, why do we still need ACLs? +With all of the above, why do we still need ACLs?

First of all, ACLs provide you with greater flexibility and more -control, even if you don't use the sysctl optoins. Perhaps you aren't -convinced now, but after reading the following sections, I'm sure you -will be :) +control, even if you do not use the sysctl options. You may not be +convinced now, but after reading the following sections, you just might +be. :)

@@ -581,7 +581,7 @@ Otherwise an attacker can simply deactivate all protections we provide. You must make sure that all initscripts are read-only and that -root doesn't have access to adding modules or performing raw i/o +root doesn't have the priveleges to add modules or perform raw I/O operations. All sysctl options must be set at startup, and after setting all these options, the grsec_lock entry must be activated. @@ -644,7 +644,7 @@ next to the restrictions you entered for "/usr/bin/sendmail".

If a subject has object restrictions which are also restricted by a -parent ACL structure, then the restriction of the first subject have +parent ACL structure, then the restriction of the first subject has a higher priority than the inherited restrictions on those objects.

@@ -678,7 +678,7 @@ PaX on this subject XENABLES the RANDEXEC (Randomize ET_EXEC base) feature of PaX on this subject OOverride the mmap() and ptrace() checks for this subject -AProtect the shared memory of this subject. No other processes but processes contained within this subject may access the shared memory of this subject. +AProtect the shared memory of this subject. None except the processes contained within this subject may access the shared memory of this subject. KWhen processes belonging to this subject generate an alert, kill the process CWhen processes belonging to this subject generate an alert, kill the process and all processes belonging to the IP of the attacker (if there was an IP attached to the process) TEnsures this process can never execute any trojaned code @@ -697,7 +697,7 @@ The following table explains the possible object modes. -rThis object can be opened for reading. This is default +rThis object can be opened for reading. This is the default if no flags are given.wThis object can be opened for writing or appending.xThis object can be executed (or mmapd with PROT_EXEC into a task). @@ -722,9 +722,9 @@ if no flags are given. On every event, the kernel will check the ACLs for the executed process (and if that isn't available or it inherits permissions, it will check the ACLs for the directory that process is located in -and so on untill it reaches the ACL for /) and the requested +and so on until it reaches the ACL for /) and the requested object (or the parent ACLs if there is no ACL for the object). Only if -both ACLs allow the event it will be executed. +both ACLs allow the event will it be executed.

@@ -754,9 +754,9 @@ the following resource definitions:

Mode	Description

-After the system resource you must define 2 values. The first one is the +After the system resource you must define two values. The first one is the "soft limit", meaning that the user running that process will receive a -warning that he has crossed the resource limit. The second one is the +warning that the resource limit has been crossed. The second one is the "hard limit", which is the actual enforced limit.

@@ -771,7 +771,7 @@ warning that he has crossed the resource limit. The second one is the

You have to define a default ACL for your system first. The following -can be used as default ACL: +can be used as a default ACL:

@@ -837,10 +837,10 @@ can be used as default ACL:

-The reason that a default ACL is needed is because of the forementioned -inheritance. Note that permissions on an ACL system is controlled both +The reason that a default ACL is needed is because of the aforementioned +inheritance. Note that permissions on an ACL system are controlled both by the ACL on an object and the DAC (Discretionary Access -Control) permission (rwxrwxrwx). Only if both systems agree access is +Control) permission (rwxrwxrwx). Only if both systems agree is access granted.

@@ -969,14 +969,14 @@ obvious reasons.

-We also allow apache to connect to a DNS server, and bind to 2 +We also allow apache to connect to a DNS server, and to bind to 2 ports: 80 (http) and 443 (https).

You can see that the subject mode is different from init's: oXA. This means that we override the default ACL, enable the -RANDEXEC feature of PaX and restrict the use of it's shared memory to +RANDEXEC feature of PaX and restrict the use of its shared memory to objects described in this ACL.

@@ -1057,7 +1057,7 @@ system. Luckily for you there is a learning mode in grSecurity.

In the learning mode grSecurity will audit everything a certain process does, and log it into a temporary ACL. Afterwards, you can dump it -into an ACL file and, if necessary, make further adjustements. +into an ACL file and, if necessary, make further adjustments.

@@ -1092,12 +1092,12 @@ single process while the rest of the system remains protected as usual.

-To enable process-base learning mode on a subject we would first need to -add it to our ACL system. +To enable process-base learning mode on a subject you first need to +add it to your ACL system.

-We can change the flags on an ACL at any given time when we are in admin +You can change the flags on an ACL at any given time when you are in admin mode. @@ -1153,7 +1153,7 @@ A more restrictive ACL for learning mode might look like this:

-Now we reload the grSecurity ACL system with gradmn. +Now you reload the grSecurity ACL system with gradmn.

@@ -1163,9 +1163,9 @@ Now we reload the grSecurity ACL system with gradmn.
 
 You should now use this application as thouroughly as possible, since
 the learning mode uses a threshold-based system to determine the ACLs.
-If the application is something that uses authentification you should
+If the application is something that uses authentication you should
 log on/off to that service which will cause it to do its necessary
-authentification calls.
+authentication calls.
 
 
 
@@ -1192,7 +1192,7 @@ repeated about 4 times.
 

 When you think the tool has been run long enough, go in admin mode with 
 gradm -a (or disable the ACL system with gradm -D) and dump
-the ACLs into a file. The following will append the new learned ACLs to
+the ACLs into a file. The following will append the newly learned ACLs to
 output.acl. 
 
 
@@ -1202,7 +1202,7 @@ the ACLs into a file. The following will append the new learned ACLs to

-You should read the proposed ACL thouroughly and make changes if deemed +You should read the proposed ACL thoroughly and make the changes you deem necessary. If you know your service will be doing name service lookups you might want to add the following to the final ACLs result.

@@ -1226,7 +1226,7 @@ you might want to add the following to the final ACLs result.

With sysctl, you can "talk" to the kernel by inserting values in files provided by /proc, or with the sysctl command. It -provides you with a flexible way to change kernelvariables on the fly +provides you with a flexible way to change kernel variables on the fly without the need for recompiling and rebooting a kernel.

@@ -1237,13 +1237,13 @@ without the need for recompiling and rebooting a kernel.

-As you read previously, several grSecurity options can be enabled/disabled -on the fly using sysctl. There are 4 ways in which you can change the -sysctl variables. +As has been mentioned previously, several grSecurity options can be +enabled and disabled on the fly using sysctl. There are four ways in which +you can change the sysctl variables.

-The first one is hardcoding the values in /etc/sysctl.conf, +The first one is hardcoding the values into /etc/sysctl.conf, using the following syntax:

@@ -1253,7 +1253,7 @@ place.of.the.variable = value

-For instance, to deny using pivotroot in chrootjails, you would set +For instance, to deny using pivotroot in chroot jails, you would set the following:

@@ -1285,7 +1285,7 @@ you can use:

-The fourth way is by echo'ing the variable's value into the +The fourth way is by echoing the variable's value into the appropriate file in /proc/sys. For instance, to restrict the usage of dmesg:

@@ -1304,7 +1304,7 @@ usage of dmesg:

-Now that you know how to write or change ACLs, it is time to install the +Now that you know how to write and change ACLs, it is time to install the Gentoo ACLs on your system. Don't forget to use a kernel with grSecurity compiled-in!

@@ -1378,7 +1378,7 @@ Password written in /etc/grsec/pw.

To lock the grSecurity options, you should set kernel.grsecurity.lock = 1. However, this is a lock in the -pure meaning of it's word. If you activate it, you won't be able +pure meaning of its word. If you activate it, you won't be able to make changes to the ACL system (including activating, restarting or shutting down) or grSecurity options. So you must activate the ACL system before setting the lock. @@ -1425,17 +1425,17 @@ file owner ID must be equal to the user ID, except where CAP_FSETID is applicable. It doesn't override MAC and DAC restrictions. 04. CAP_FSETID -Overrides the following restrictions, that the effective user ID shall -match the file owner ID, when setting the S_ISUID and S_ISGID bits on +Overrides the following restrictions that the effective user ID shall +match the file owner ID when setting the S_ISUID and S_ISGID bits on that file; that the effective group ID (or one of the supplementary group IDs) shall match the file owner ID when setting the S_ISGID bit on that file; that the S_ISUID and S_ISGID bits are cleared on successful return from chown(2) (not implemented). 05. CAP_KILL -Overrides the restriction, that the real or effective user ID of a -process, sending a signal, must match the real or effective user ID -of the process, receiving the signal. +Overrides the restriction that the real or effective user ID of a +process sending a signal must match the real or effective user ID +of the process receiving the signal. 06. CAP_SETGID Allows setgid(2) manipulation; -- cgit v1.2.3-65-gdbad