mirror/freebsd
1
0
Fork 0
mirror of https://git.FreeBSD.org/src.git synced 2024-11-29 08:08:37 +00:00
Code Issues Releases Activity

Hook up a sample LOMAC labeling policy. Unlike the old LOMAC module,

Browse Source 
the file system initial labeling policy exists in userland, and is
fed into setfsmac(1).  This is based on the old LOMAC PLM.

Approved by:	re
Obtained from:	TrustedBSD Project
Sponsored by:	DARPA, Network Associates Laboratories
This commit is contained in:
Robert Watson 2002-12-03 15:16:10 +00:00
parent c3a04e1ea4
commit df9bd3e90c
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=107549
1 changed files with 29 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
share/security/lomac-policy.contexts Normal file
View File

@ -0,0 +1,29 @@
# $FreeBSD$
#
# This is a sample LOMAC policy based upon the PLM defined in the
# original FreeBSD LOMAC port. It may be configured on a
# system via setfsmac(8).
.* lomac/high
/sbin/dhclient lomac/high[low]
/dev(/.*)? lomac/equal
# This is not an exhaustive list of all "privileged" devices.
/dev/mdctl lomac/high
/dev/pci lomac/high
/dev/k?mem lomac/high
/dev/io lomac/high
/dev/agp.* lomac/high
(/var)?/tmp(/.*)? lomac/equal
/tmp/\.X11-unix lomac/high[equal]
/tmp/\.X11-unix/.* lomac/equal
/proc(/.*)? lomac/equal
/mnt.* lomac/low
(/usr)?/home lomac/high[low]
(/usr)?/home/.* lomac/low
/var/mail(/.*)? lomac/low
/var/spool/mqueue(/.*)? lomac/low
(/mnt)?/cdrom(/.*)? lomac/high
(/usr)?/home/(ftp|samba)(/.*)? lomac/high
/var/log/sendmail\.st lomac/low
/var/run/utmp lomac/equal
/var/log/(lastlog|wtmp) lomac/equal