Grsecurity/Appendix/Subject Modes

Grsecurity/Appendix Subject Modes Subject Attributes Role Attributes ModeMeaningaAllow this process to talk to the /dev/grsec device.bEnable process accounting for processes in this subject.dProtect the /proc/<pid>/fd, /proc/<pid>/mem, /proc/<pid>/cmdline, and /proc/<pid>/environ entries for processes in this subject,hThis process is hidden and only viewable by processes with the v mode.iEnable inheritance-based learning, causing all accesses of this subject and anything it executes to be logged as originating from this subject. The policy generated from this learning will have the inheritance flag added to every file executed from this subject.kThis process can kill protected processes.lEnables learning mode for this process.oOverride ACL inheritance for this process.pThis process is protected; it can only be killed by processes with the k mode, or by processes within the same subject.rRelax ptrace restrictions (allows ptracing of processes other than one's own children).s(In v2.2.1 and above): Enable AT_SECURE when entering this subject. This enables the same environment sanitization that occurs in glibc upon execution of a suid binary.tAllow ptracing of any process (do not use unless necessary, allows ptrace to cross subject boundaries). This flag also allows a process to use CLONE_FS and execute a binary that causes a subject change.vThis process can view hidden processes.xAllows executable anonymous shared memory for this subject.AProtect the shared memory of this subject. No other processes but processes contained within this subject may access the shared memory of this subject.CAuto-kill all processes belonging to the attacker's IP address upon violation of security policy.KWhen processes belonging to this subject generate an alert, kill the process.OAllow loading of writable libraries.TDeny execution of binaries or scripts that are writable by any other subject in the policy. This flag is evaluated at policy enable time. All binaries with execute permission that are writable by another subject (ignoring special roles) will be reported and the RBAC system will not allow itself to be enabled until the changes are made. Subject Attributes Role Attributes deep