GRADM(8)

👑 GRADM — the grsecurity RBAC admin bestie 👑

okay so this is gradm, section 8 of the System Manager's Manual, and it's literally the administration program for the grsecurity RBAC system. sit down, grab a strawberry 🍓, we're doing this.

---

✨ NAME ✨

gradm — Administration program for the grsecurity RBAC system

---

🌸 SYNOPSIS 🌸

gradm [ -E ] [ -R ] [ -C ] [ -F ] [ -L <logfile> ] [ -O
<filename|stream> ] [ -M <filename|uid> ] [ -D ] [ -P [rolename] ] [ -a
<rolename> ] [ -n <rolename> ] [ -p <rolename> ] [ -u ] [ -V ] [ -h ] [
-v ]

---

💖 DESCRIPTION 💖

gradm is the userspace RBAC parsing and authentication program for grsecurity. it's giving main character energy for real.

grsecurity aims to be a complete security system for Linux 2.4. and gradm? she does several tasks for the RBAC system, including authenticating via a password to the kernel and parsing rules to be passed to the kernel. multi-tasking queen 👑

---

🎀 OPTIONS 🎀

💀 heads up bestie: all options to gradm are mutually exclusive, except for -L and -O. the way that those two are the only ones allowed to hang out together… iconic.

• -E — Enable the RBAC system. turn it ON, we're live ✨
• -R — Reload the RBAC system. only valid while in admin mode, so don't try it unless you're actually the admin bestie.
• -C — Perform a check of the RBAC policy, running the same analysis against it that is performed when enabling. like a vibe check but for your ruleset 🧚
• -F — Toggle full learning mode. if you use it only with -L, it enables the RBAC system in full learning mode. if you use it with -L and -O, it parses the full learning logs and generates a complete ruleset. glow-up arc fr fr 🌈
• -M <filename|uid> — Remove an execution ban on a given uid or filename that has been put in place by the RES_CRASH resource restriction of the RBAC system. un-grounding someone, basically 🙈
• -L <logfile> — Parses the learning logs. takes an argument which specifies the logfile to scan for the learning logs. if - is specified as the logfile, stdin will be used as the learning log. this option can be used with -E, -O, or -F. 📚
• -O <filename|stream> — Specifies output mode. requires a single argument that can be "stdout", "stderr", or a regular file. only used with -L or -F. choose your destiny 💅
• -D — Disable the RBAC system. nap time 😴
• -P [rolename] — Without an argument, it sets the password for administering the RBAC system. with a role name as an argument, it sets the password for that given special role. 🔐
• -a <rolename> — Authenticate to a special role that requires a password. keys out, bestie 🗝️
• -n <rolename> — Authenticate to a special role that does not require a password. no key needed, walk right in 🚪
• -p <rolename> — Authenticate through PAM to a special role. PAM said come through 🫶
• -u — Removes yourself from your current special role, reverting back to the normal role selection. to be used, for instance, for logging out of an admin role without exiting your shell. no need to close the whole tab, just log out of the role 💫
• -V — Displays verbose policy statistics when enabling the RBAC system or checking the RBAC policy. can only be used with -C, -E, or -F -L <filename>. numbers, but make it loud 📊
• -h — Display help information. lost? same. here's the map 🗺️
• -v — Print version information and exit. who am I? what am I? ⭐

---

🐛 REPORTING BUGS 🐛

found a bug? 😭 please include as much information as possible (using any available debugging options) and send bug reports for gradm or the grsecurity RBAC system to spender@grsecurity.net. give them everything, they need the full picture.

---

👑 AUTHOR 👑

grsecurity and gradm were created and are maintained by Brad Spengler <spender@grsecurity.net>. legend behaviour, no cap.

---

and that's the whole page bestie 💖 this was GRADM(8) from the System Manager's Manual — the version and date live on that last line of the original page, so consider this your lil sign-off: same manual, same section 8, same energy. periodt. 💅✨