Commit Graph

8 Commits

Author SHA1 Message Date
David Malone
89ddbd45e5 Add some new options to mac_bsdestended. We can now match on:
subject: ranges of uid, ranges of gid, jail id
	objects: ranges of uid, ranges of gid, filesystem,
		object is suid, object is sgid, object matches subject uid/gid
		object type

We can also negate individual conditions. The ruleset language is
a superset of the previous language, so old rules should continue
to work.

These changes require a change to the API between libugidfw and the
mac_bsdextended module. Add a version number, so we can tell if
we're running mismatched versions.

Update man pages to reflect changes, add extra test cases to
test_ugidfw.c and add a shell script that checks that the the
module seems to do what we expect.

Suggestions from: rwatson, trhodes
Reviewed by: trhodes
MFC after: 2 months
2006-04-23 17:06:18 +00:00
Robert Watson
89afecd482 In practice, you need to include <sys/types.h> and
<security/mac_bsdextended/mac_bsdextended.h> in order to include
<ugidfw.h>, so document that.

MFC after:	3 days
2005-04-16 11:32:46 +00:00
Ruslan Ermilov
1a0a934547 Mechanically kill hard sentence breaks. 2004-07-02 23:52:20 +00:00
Ruslan Ermilov
862b46f607 Markup, grammar, punctuation. 2004-07-01 18:20:57 +00:00
Robert Watson
47ab23aa82 Add bsde_add_rule(), which is similar to bsde_set_rule() except that
the caller does not specify the rule number -- instead, the kernel
module is probed for the next available rule, which is then used.

Obtained from:	TrustedBSD Project
Sponsored by:	DARPA, McAfee Research
2004-02-25 03:24:39 +00:00
Ruslan Ermilov
9be025500d Assorted mdoc(7) fixes. 2003-06-01 19:41:49 +00:00
Chris Costello
6e238d7604 Correct a couple small typos.
Submitted by:	Attila Nagy <bra@fsn.hu>
2003-01-07 13:18:21 +00:00
Chris Costello
d69f82076b Document the file system firewall interface library functions.
Sponsored by:	DARPA, Network Associates Laboratories
2003-01-07 11:23:43 +00:00