/
gradm.8
162 lines (139 loc) · 2.9 KB
/
gradm.8
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
.TH GRADM 8
.SH NAME
gradm \- Administration program for the grsecurity RBAC system
.SH SYNOPSIS
.B gradm
[
.B \-E
]
[
.B \-R
]
[
.B \-C
]
[
.B \-F
]
[
.B \-L <logfile>
]
[
.B \-O <filename|stream>
]
[
.B \-M
<filename|uid>
]
[
.B \-D
]
[
.B \-P [rolename]
]
[
.B \-a <rolename>
]
[
.B \-n <rolename>
]
[
.B \-p <rolename>
]
[
.B \-u
]
[
.B \-V
]
[
.B \-h
]
[
.B \-v
]
.SH DESCRIPTION
.I gradm
is the userspace RBAC parsing and authentication program for
.I grsecurity
grsecurity aims to be a complete security system for Linux 2.4. gradm
performs several tasks for the RBAC system including authenticated via a
password to the kernel and parsing rules to be passed to the kernel.
.SH OPTIONS
.TP
All options to gradm are mutually exclusive, except for -L and -O.
.TP
.B \-E
Enable the RBAC system
.TP
.B \-R
Reload the RBAC system (only valid while in admin mode)
.TP
.B \-C
Perform a check of the RBAC policy, running the same analysis
against it that is performed when enabling.
.TP
.B \-F
Toggle full learning mode.
If used only with -L, it enables the RBAC system in full learning
mode.
If used with -L and -O, it parses the full learning logs and
generates a complete ruleset.
.TP
.B \-M <filename|uid>
Remove an execution ban on a given uid or filename that has been
put in place by the RES_CRASH resource restriction of the RBAC system.
.TP
.B \-L <logfile>
Parses the learning logs. Accepts an argument which
specifies the logfile to scan for the learning logs.
If "-" is specified as the logfile, stdin will be used
as the learning log.
This option can be used with -E, -O, or -F.
.TP
.B \-O <filename|stream>
Specifies output mode. Requires a single argument that can be
"stdout", "stderr", or a regular file. Only used with -L or -F.
.TP
.B \-D
Disable the RBAC system
.TP
.B \-P [rolename]
Without an argument, it sets the password for administering
the RBAC system. With a role name as an argument, it sets
the password for that given special role.
.TP
.B \-a <rolename>
Authenticate to a special role that requires a password.
.TP
.B \-n <rolename>
Authenticate to a special role that does not require a password.
.TP
.B \-p <rolename>
Authenticate through PAM to a special role.
.TP
.B \-u
Removes yourself from your current special role, reverting back
to the normal role selection. To be used, for instance, for logging
out of an admin role without exiting your shell.
.TP
.B \-V
Displays verbose policy statistics when enabling the RBAC system
or checking the RBAC policy.
Can only be used with -C, -E, or -F -L <filename>
.TP
.B \-h
Display help information
.TP
.B \-v
Print version information and exit
.TP
.BR
.SH REPORTING BUGS
Please include as much information as possible(using any available debugging
options) and send bug reports for gradm or the grsecurity RBAC system
to
.B spender@grsecurity.net.
.SH AUTHOR
.B grsecurity and gradm
were created and are maintained by Brad Spengler <spender@grsecurity.net>