Hook up a sample LOMAC labeling policy. Unlike the old LOMAC module,
the file system initial labeling policy exists in userland, and is fed into setfsmac(1). This is based on the old LOMAC PLM. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
This commit is contained in:
parent
c3a04e1ea4
commit
df9bd3e90c
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=107549
29
share/security/lomac-policy.contexts
Normal file
29
share/security/lomac-policy.contexts
Normal file
@ -0,0 +1,29 @@
|
|||||||
|
# $FreeBSD$
|
||||||
|
#
|
||||||
|
# This is a sample LOMAC policy based upon the PLM defined in the
|
||||||
|
# original FreeBSD LOMAC port. It may be configured on a
|
||||||
|
# system via setfsmac(8).
|
||||||
|
|
||||||
|
.* lomac/high
|
||||||
|
/sbin/dhclient lomac/high[low]
|
||||||
|
/dev(/.*)? lomac/equal
|
||||||
|
# This is not an exhaustive list of all "privileged" devices.
|
||||||
|
/dev/mdctl lomac/high
|
||||||
|
/dev/pci lomac/high
|
||||||
|
/dev/k?mem lomac/high
|
||||||
|
/dev/io lomac/high
|
||||||
|
/dev/agp.* lomac/high
|
||||||
|
(/var)?/tmp(/.*)? lomac/equal
|
||||||
|
/tmp/\.X11-unix lomac/high[equal]
|
||||||
|
/tmp/\.X11-unix/.* lomac/equal
|
||||||
|
/proc(/.*)? lomac/equal
|
||||||
|
/mnt.* lomac/low
|
||||||
|
(/usr)?/home lomac/high[low]
|
||||||
|
(/usr)?/home/.* lomac/low
|
||||||
|
/var/mail(/.*)? lomac/low
|
||||||
|
/var/spool/mqueue(/.*)? lomac/low
|
||||||
|
(/mnt)?/cdrom(/.*)? lomac/high
|
||||||
|
(/usr)?/home/(ftp|samba)(/.*)? lomac/high
|
||||||
|
/var/log/sendmail\.st lomac/low
|
||||||
|
/var/run/utmp lomac/equal
|
||||||
|
/var/log/(lastlog|wtmp) lomac/equal
|
Loading…
Reference in New Issue
Block a user