Grsecurity/Appendix/Object Modes

Grsecurity/Appendix Object Modes PaX Flags Subject Attributes ModeMeaning+ Object Permission ModesnoneLack of any of the below modes implies "find" access to the object. The object can be listed and have its ownership, size, etc. information obtained, but cannot be read or modified.aThis object can be opened for appending.cAllow creation of the file/directory.dAllow deletion of the file/directory.fNeeded to mark the pipe used for communication with init to transfer the privilege of the persistent role; only valid within a persistent role. Transfer only occurs when the file is opened for writing.hThis object is hidden.iThis mode only applies to binaries. When the object is executed, it inherits the ACL of the subject in which it was contained.lLowercase L. Allow a hardlink at this path. Hardlinking requires a minimum of c and l modes, and the target link cannot have any greater permission than the source file.mAllow creation of setuid/setgid files/directories and modification of files/directories to be setuid/setgid.pReject all ptraces to this object.rThis object can be opened for reading.tThis object can be ptraced, but cannot modify the running task. This is referred to as a 'read-only ptrace'.wThis object can be opened for writing or appending.xThis object can be executed (or mmap'd with PROT_EXEC into a task). ModeMeaning+ Object Auditing FlagsAAudit successful appends to this object.CAudit the creation of the file/directory.DAudit the deletion of the file/directory.FAudit successful finds of this object.IAudit successful ACL inherits of this object.LAudit link creation.MAudit the setuid/setgid creation/modification.RAudit successful reads to this object.WAudit successful writes to this object.XAudit successful execs of this object. ModeMeaning+ Other Object FlagssLogs will be suppressed for denied access to this object. PaX Flags Subject Attributes deep