Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I installed 'linux-patch-grsecurity2' and it has some sort of interface.

~$ sudo gradm2
gradm 2.1.14
grsecurity administration program

Usage: gradm [option] ...

        gradm -P
        gradm -F -L /etc/grsec/learning.logs -O /etc/grsec/policy
        -E, --enable    Enable the grsecurity RBAC system
        -D, --disable   Disable the grsecurity RBAC system
        -C, --check     Check RBAC policy for errors
        -S, --status    Check status of RBAC system
        -F, --fulllearn Enable full system learning
        -P [rolename], --passwd
                        Create password for RBAC administration
                        or a special role
        -R, --reload    Reload the RBAC system while in admin mode
        -L <filename>, --learn
                        Specify the pathname for learning logs
        -O <filename>, --output
                        Specify where to place policies generated from
                        learning mode
        -M <filename|uid>, --modsegv
                        Remove a ban on a specific file or UID
        -a <rolename> , --auth
                        Authenticates to a special role that requires auth
        -u, --unauth    Remove yourself from your current special role
        -n <rolename> , --noauth
                        Transitions to a special role that doesn't
                        require authentication
        -p <rolename> , --pamauth
                        Authenticates to a special role through PAM
        -V, --verbose   Display verbose policy statistics when enabling system
        -h, --help      Display this help
        -v, --version   Display version information

I didn't successfully find any documentation on how to use it to limit the 'ps aux' list for users?

share|improve this question
Related: how to do it with SELinux. – Gilles Apr 23 '11 at 12:34
Hmm, that subject line kinda sounds like a cracking attempt. – penguin359 Apr 25 '11 at 17:50
kill -9 <your_pid> :D – Kevin M Apr 26 '11 at 1:49

You need to set the proper kernel configuration options. Here is the relevant part of the documentation. I don't think you can do it from the gradm policy file.

share|improve this answer
The reference to the kernel configuration options is vague, and while the answer to the question is indeed in the documentation, you could've been more specific. – countermode Apr 13 '14 at 21:45

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.