From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <zsh-users-return-16287-mason-zsh=primenet.com.au@zsh.org>
Received: (qmail 8612 invoked by alias); 26 Aug 2011 20:26:47 -0000
Mailing-List: contact zsh-users-help@zsh.org; run by ezmlm
Precedence: bulk
X-No-Archive: yes
List-Id: Zsh Users List <zsh-users.zsh.org>
List-Post: <mailto:zsh-users@zsh.org>
List-Help: <mailto:zsh-users-help@zsh.org>
X-Seq: 16287
Received: (qmail 13999 invoked from network); 26 Aug 2011 20:26:46 -0000
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on f.primenet.com.au
X-Spam-Level: 
X-Spam-Status: No, score=-2.7 required=5.0 tests=BAYES_00,DKIM_SIGNED,
	DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FROM,RCVD_IN_DNSWL_LOW autolearn=ham
	version=3.3.1
Received-SPF: pass (ns1.primenet.com.au: SPF record at _spf.google.com designates 209.85.161.43 as permitted sender)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=gamma;
        h=message-id:date:from:user-agent:mime-version:to:subject
         :content-type:content-transfer-encoding;
        bh=AxptK3Ub4cK1t7c3+b5OJqYS4t8dNacLnm+jv6aLgsM=;
        b=SzpNmFINrQ8e5N+2ncboFQKEvXwE8wJ6hlONPhB7RwY93b2MKVWGh6vmMmG9ifZSqu
         Y8zsSIZyIWjlnCm6DQLjAwENDSIA450AXyt1xI1qaOUKm74C+ggwi31GgHuI8lhFuLaN
         W0cIxeN71WwUpkEdyQxrhVVMsmsTsIeSYZ8O4=
Message-ID: <4E57FFA8.2060105@gmail.com>
Date: Fri, 26 Aug 2011 22:18:48 +0200
From: Piotr Karbowski <jabberuser@gmail.com>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:6.0) Gecko/20110821 Thunderbird/6.0
MIME-Version: 1.0
To: zsh-users <zsh-users@zsh.org>
Subject: Zsh trying to access gcc and binutils binaries on login, why?
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

Recenty I was fooling around with grsecurity's rbac and found out that 
after each login I have a lot of logs about denied access 
/usr/i686-pc-linux-gnu/ with parent '/bin/zsh'

Why would zsh want execute gcc on login? The list of files:

/usr/i686-pc-linux-gnu/gcc-bin/4.4.5/i686-pc-linux-gnu-c++
/usr/i686-pc-linux-gnu/binutils-bin/2.20.1/ld
/usr/i686-pc-linux-gnu/gcc-bin/4.4.5/i686-pc-linux-gnu-g++
/usr/i686-pc-linux-gnu/gcc-bin/4.4.5/i686-pc-linux-gnu-gfortran
/usr/i686-pc-linux-gnu/gcc-bin/4.4.5/i686-pc-linux-gnu-gcc
/usr/i686-pc-linux-gnu/binutils-bin/2.20.1/readelf
/usr/i686-pc-linux-gnu/binutils-bin/2.20.1/c++filt
/usr/i686-pc-linux-gnu/binutils-bin/2.20.1/size
/usr/i686-pc-linux-gnu/binutils-bin/2.20.1/ar
/usr/i686-pc-linux-gnu/binutils-bin/2.20.1/addr2line
/usr/i686-pc-linux-gnu/binutils-bin/2.20.1/objcopy

-- Piotr.