The next few sections will discuss MAC policies which use labels.
Note: This is an example configuration only and should not be considered for a production implementation. The goal is to document and show the syntax as well as examples for implementation and testing.
For these policies to work correctly several preparations must be made.
The following changes are required in the login.conf file:
An insecure class, or another class of similar type, must be added. The login class of insecure is not required and just used as an example here; different configurations may use another class name.
The insecure class should have the following settings and definitions. Several of these can be altered but the line which defines the default label is a requirement and must remain.
insecure:\ :copyright=/etc/COPYRIGHT:\ :welcome=/etc/motd:\ :setenv=MAIL=/var/mail/$,BLOCKSIZE=K:\ :path=~/bin:/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin:\ :manpath=/usr/share/man /usr/local/man:\ :nologin=/usr/sbin/nologin:\ :cputime=1h30m:\ :datasize=8M:\ :vmemoryuse=100M:\ :stacksize=2M:\ :memorylocked=4M:\ :memoryuse=8M:\ :filesize=8M:\ :coredumpsize=8M:\ :openfiles=24:\ :maxproc=32:\ :priority=0:\ :requirehome:\ :passwordtime=91d:\ :umask=022:\ :ignoretime@:\ :label=partition/13,mls/5,biba/low:
The root should also be placed into a login class; otherwise, almost every command executed by root will require the use of setpmac.
Warning: Rebuilding the login.conf database may cause some errors later with the daemon class. Simply uncommenting the daemon account and rebuilding the database should alleviate these issues.
Ensure that all partitions on which MAC labeling will be implemented support the multilabel. We must do this because many of the examples here contain different labels for testing purposes. Review the output from the mount command as a precautionary measure.
This, and other documents, can be downloaded from ftp://ftp.FreeBSD.org/pub/FreeBSD/doc/.
Hosting by: Hurra Communications Ltd.
Generated: 2007-01-26 17:58:42