freebsd-dev/sys/modules/mac_portacl/Makefile

# $FreeBSD$

.PATH: ${.CURDIR}/../../security/mac_portacl

KMOD=	mac_portacl
SRCS=	mac_portacl.c

.include <bsd.kmod.mk>
A cute yet small MAC policy that provides a simple ACL mechanism to permit users and groups to bind ports for TCP or UDP, and is intended to be combined with the recently committed support for net.inet.ip.portrange.reservedhigh. The policy is twiddled using sysctl(8). To use this module, you will need to compile in MAC support, and probably set reservedhigh to 0, then twiddle security.mac.portacl.rules to set things as desired. This policy module only restricts ports explicitly bound using bind(), not implicitly bound ports where the port number is selected by the IP stack. It appears to work properly in my local configuration, but needs more broad testing. A sample policy might be: # sysctl security.mac.portacl.rules="uid:425:tcp:80,uid:425:tcp:79" This permits uid 425 to bind TCP sockets to ports 79 and 80. Currently no distinction is made for incoming vs. outgoing ports with TCP, although that would probably be easy to add. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories 2003-03-02 23:01:42 +00:00			`# $FreeBSD$`

			`.PATH: ${.CURDIR}/../../security/mac_portacl`

			`KMOD= mac_portacl`
mac_portacl.c no longer references vnode_if.h. 2004-12-30 13:49:01 +00:00			`SRCS= mac_portacl.c`
A cute yet small MAC policy that provides a simple ACL mechanism to permit users and groups to bind ports for TCP or UDP, and is intended to be combined with the recently committed support for net.inet.ip.portrange.reservedhigh. The policy is twiddled using sysctl(8). To use this module, you will need to compile in MAC support, and probably set reservedhigh to 0, then twiddle security.mac.portacl.rules to set things as desired. This policy module only restricts ports explicitly bound using bind(), not implicitly bound ports where the port number is selected by the IP stack. It appears to work properly in my local configuration, but needs more broad testing. A sample policy might be: # sysctl security.mac.portacl.rules="uid:425:tcp:80,uid:425:tcp:79" This permits uid 425 to bind TCP sockets to ports 79 and 80. Currently no distinction is made for incoming vs. outgoing ports with TCP, although that would probably be easy to add. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories 2003-03-02 23:01:42 +00:00
			`.include <bsd.kmod.mk>`