Module name: mac_bsdextended.ko
Kernel configuration line: options MAC_BSDEXTENDED
Boot option: mac_bsdextended_load="YES"
The mac_bsdextended(4) module enforces the file system firewall. This module's policy provides an extension to the standard file system permissions model, permitting an administrator to create a firewall-like ruleset to protect files, utilities, and directories in the file system hierarchy.
Extreme caution should be taken when working with this module; incorrect use could block access to certain parts of the file system.
After the mac_bsdextended(4) module has been loaded, the following command may be used to list the current rule configuration:
# ugidfw list 0 slots, 0 rules
As expected, there are no rules defined. This means that everything is still completely accessible. To create a rule which will block all access by users but leave root unaffected, simply run the following command:
# ugidfw add subject not uid root new object not uid root mode n
Note: In releases prior to FreeBSD 5.3, the add parameter did not exist. In those cases the set should be used instead. See below for a command example.
This is a very bad idea as it will block all users from issuing even the most simple commands, such as ls. A more patriotic list of rules might be:
# ugidfw set 2 subject uid user1 object uid user2 mode n # ugidfw set 3 subject uid user1 object gid user2 mode n
This will block any and all access, including directory listings, to user2's home directory from the username user1.
In place of user1, the not uid user2 could be passed. This will enforce the same access restrictions above for all users in place of just one user.
Note: The root user will be unaffected by these changes.
This, and other documents, can be downloaded from ftp://ftp.FreeBSD.org/pub/FreeBSD/doc/.
Hosting by: Hurra Communications Ltd.
Generated: 2007-01-26 17:58:42