Allow snmpd to read /proc/net/* when running a grsecurity kernel and the grsec_proc group

Question

I have rented a VPS from OVH (the Kimsufi 2G), and I'm having troubles getting snmpd to work correctly.

The box is a Debian Squeeze running an OVH custom kernel:

root@vps:~# uname -a
Linux vps 2.6.38.2-grsec-xxxx-grs-ipv6-64 #2 SMP Thu Aug 25 16:40:22 UTC 2011 x86_64 GNU/Linux

The problem is snmpd is spamming the syslog with cannot open /proc/net/*:

root@vps:~# tail -f /var/log/syslog
Feb  8 23:57:38 vps snmpd[32481]: cannot open /proc/net/dev ...
Feb  8 23:57:53 vps snmpd[32481]: cannot open /proc/net/dev ...
Feb  8 23:58:01 vps /USR/SBIN/CRON[3074]: (root) CMD (/usr/local/rtm/bin/rtm 39 > /dev/null 2> /dev/null)
Feb  8 23:58:08 vps snmpd[32481]: cannot open /proc/net/dev ...
Feb  8 23:58:23 vps snmpd[32481]: cannot open /proc/net/dev ...
Feb  8 23:58:38 vps snmpd[32481]: cannot open /proc/net/snmp ...
Feb  8 23:58:38 vps snmpd[32481]: cannot open /proc/net/dev ...
Feb  8 23:58:53 vps snmpd[32481]: cannot open /proc/net/dev ...
Feb  8 23:59:01 vps /USR/SBIN/CRON[3117]: (root) CMD (/usr/local/rtm/bin/rtm 39 > /dev/null 2> /dev/null)
Feb  8 23:59:08 vps snmpd[32481]: cannot open /proc/net/dev ...

It seems the problem is caused by the grsecurity kernel patch, as stated here and here.

But there's no grsec_proc group, so I can't change the group snmpd runs as, as mentioned in the first link, and recompiling and installing a new kernel is not an option, as I'm not expert enough.

Is there another way to resolve this issue?

Answer 1

You need to enable the proc group in the grsec kernel config:

#
# Filesystem Protections
#
[…]
CONFIG_GRKERNSEC_PROC_USERGROUP=y
CONFIG_GRKERNSEC_PROC_GID=1005
[…]

Then you have to put the user you want to have access to /proc in the group with group-id:1005.