Интерактивная система просмотра системных руководств (man-ов)
mac_bsdextended (4)
>> mac_bsdextended (4) ( FreeBSD man: Специальные файлы /dev/* )
BSD mandoc
NAME
mac_bsdextended
- file system firewall policy
SYNOPSIS
To compile the file system firewall policy into your kernel,
place the following lines in your kernel configuration file:
options MACoptions MAC_BSDEXTENDED
Alternately, to load the file system firewall policy module at boot time,
place the following line in your kernel configuration file:
options MAC
and in
loader.conf5:
mac_bsdextended_load="YES"
DESCRIPTION
The
security policy module provides an interface for the system administrator
to impose mandatory rules regarding users and some system objects.
Rules are uploaded to the module
(typically using
ugidfw(8),
or some other tool utilizing
libugidfw(3))
where they are stored internally
and used to determine whether to allow or deny specific accesses
(see
ugidfw(8)).
IMPLEMENTATION NOTES
While the traditional
mac(9)
entry points are implemented,
policy labels are not used;
instead, access control decisions are made by iterating through the internal
list of rules until a rule
which denies the particular access
is found,
or the end of the list is reached.
The
policy works similar to
ipfw(8)
or by using a
first match semantic
This means that not all rules are applied,
only the first matched rule; thus if
Rule A allows access and Rule B blocks
access, Rule B will never be applied.
Sysctls
The following sysctls may be used to tweak the behavior of
:
security.mac.bsdextended.enabled
Set to zero or one to toggle the policy off or on.
security.mac.bsdextended.rule_count
List the number of defined rules, the maximum rule count is
current set at 256.
security.mac.bsdextended.rule_slots
List the number of rule slots currently being used.
security.mac.bsdextended.firstmatch_enabled
Toggle between the old all rules match functionality
and the new first rule matches functionality.
This is enabled by default.
security.mac.bsdextended.logging
Log all access violations via the
AUTHPRIVsyslog(3)
facility.
The
policy module first appeared in
Fx 5.0
and was developed by the
TrustedBSD
Project.
The "match first case" and logging capabilities were later added by
An Tom Rhodes Aq trhodes@FreeBSD.org .
AUTHORS
This software was contributed to the
Fx Project by NAI Labs, the Security Research Division of Network Associates
Inc. under DARPA/SPAWAR contract N66001-01-C-8035
(``CBOSS''
)
as part of the DARPA CHATS research program.
