sys-apps/gradm/files/grsecurity.rc


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79

#!/sbin/runscript
# Copyright 1999-2003 Gentoo Technologies, Inc.
# Distributed under the terms of the GNU General Public License v2
# $Header: /var/cvsroot/gentoo-x86/sys-apps/gradm/files/grsecurity.rc,v 1.7 2003/06/16 18:37:01 solar Exp $

PROCDIR=/proc/sys/kernel/grsecurity

depend() {
	need bootmisc localmount
}

checkconfig() {
	if [ ! -d ${PROCDIR} ] ; then
		eerror "You must have GR security turned on in your kernel."
		return 1
	fi
}

start() {
	checkconfig || return 1

	ebegin "Starting grsecurity"

	for x in ${ENABLED}; do
		# [ -f ${PROCDIR}/${x} ] && continue
		# einfo "\tEnabling kernel.grsecurity.${x}"
		case "${x}" in
		allow_ptrace_group)
			echo ${ptrace_gid} > ${PROCDIR}/ptrace_gid
			;;
		fork_bomb_prot)
			echo ${fork_bomb_gid} >${PROCDIR}/fork_bomb_gid
			echo ${fork_bomb_sec} >${PROCDIR}/fork_bomb_sec
			echo ${fork_bomb_max} >${PROCDIR}/fork_bomb_max
			;;
		socket_all)
			echo ${socket_all_gid} >${PROCDIR}/socket_all_gid
			;;
		socket_client)
			echo ${socket_client_gid} >${PROCDIR}/socket_client_gid
			;;
		socket_server)
			echo ${socket_server_gid} >${PROCDIR}/socket_server_gid
			;;
		*)
			[ -f ${PROCDIR}/${x} ] && echo 1 >${PROCDIR}/${x}
			;;
		esac
	done

	for x in ${PAGE_EXEC_EXEMPT} ; do
		[ -f ${x} ] && /sbin/chpax -p ${x}
	done

	for x in ${TRAMPOLINE_EXEMPT} ; do
		[ -f ${x} ] && /sbin/chpax -e ${x}
	done

	for x in ${MPROTECT_EXEMPT} ; do
		[ -f ${x} ] && /sbin/chpax -m ${x}
	done

	for x in ${MMAP_EXEMPT} ; do
		[ -f ${x} ] &&	/sbin/chpax -r ${x}
	done

	for x in ${SEGMENTATION_EXEMPT} ; do
		[ -f ${x} ] &&	/sbin/chpax -s ${x}
	done

	[ -f ${PROCDIR}/grsec_lock ] && echo ${LOCK} >${PROCDIR}/grsec_lock

	eend ${?}
}

#stop() {
#	ebegin "Stopping grsecurity"
#	eend ${?}
#}