When stopping ugidfw, it is not enough to just try unloading the module. If
the module is built-in to the kernel then the kldunload will fail. Rather than do this just check if there are rules and then remove them all. Add requirement on FILESYSTEMS to ensure /usr is present for /usr/sbin/ugidfw and /usr/bin/xargs. This was already effectively the ordering from rcorder(8). MFC after: 2 weeks Relnotes: yes
This commit is contained in:
parent
66157b3899
commit
10d8d828d3
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=288390
@ -3,6 +3,7 @@
|
||||
# $FreeBSD$
|
||||
|
||||
# PROVIDE: ugidfw
|
||||
# REQUIRE: FILESYSTEMS
|
||||
# BEFORE: LOGIN
|
||||
# KEYWORD: nojail shutdown
|
||||
|
||||
@ -33,9 +34,17 @@ ugidfw_start()
|
||||
|
||||
ugidfw_stop()
|
||||
{
|
||||
local rulecount
|
||||
|
||||
# Disable the policy
|
||||
#
|
||||
kldunload mac_bsdextended
|
||||
# Check for the existence of rules and flush them if needed.
|
||||
rulecount=$(sysctl -in security.mac.bsdextended.rule_count)
|
||||
if [ ${rulecount:-0} -gt 0 ]; then
|
||||
ugidfw list | sed -n '2,$p' | cut -d ' ' -f 1 | sort -r -n |
|
||||
xargs -n 1 ugidfw remove
|
||||
echo "MAC bsdextended rules flushed."
|
||||
fi
|
||||
}
|
||||
|
||||
load_rc_config $name
|
||||
|
Loading…
Reference in New Issue
Block a user