Εγχειρίδιο του FreeBSD
Προηγ | Κεφάλαιο 17 Υποχρεωτικός Έλεγχος Πρόσβασης | Επόμενο

# 17.7 The MAC bsdextended Module

Module name: `mac_bsdextended.ko`

Kernel configuration line: `options MAC_BSDEXTENDED`

Boot option: `mac_bsdextended_load="YES"`

The mac_bsdextended(4) module enforces the file system firewall. This module's policy provides an extension to the standard file system permissions model, permitting an administrator to create a firewall-like ruleset to protect files, utilities, and directories in the file system hierarchy. When access to a file system object is attempted, the list of rules is iterated until either a matching rule is located or the end is reached. This behavior may be changed by the use of a sysctl(8) parameter, security.mac.bsdextended.firstmatch_enabled. Similar to other firewall modules in FreeBSD, a file containing access control rules can be created and read by the system at boot time using an rc.conf(5) variable.

The rule list may be entered using a utility, ugidfw(8), that has a syntax similar to that of ipfw(8). More tools can be written by using the functions in the libugidfw(3) library.

Extreme caution should be taken when working with this module; incorrect use could block access to certain parts of the file system.

## 17.7.1 Examples

After the mac_bsdextended(4) module has been loaded, the following command may be used to list the current rule configuration:

    # ugidfw list
    0 slots, 0 rules

As expected, there are no rules defined. This means that everything is still completely accessible. To create a rule which will block all access by users but leave `root` unaffected, simply run the following command:

    # ugidfw add subject not uid root new object not uid root mode n

> Σημείωση: In releases prior to FreeBSD 5.3, the `add` parameter did not exist. In those cases the `set` should be used instead. See below for a command example.

This is a very bad idea as it will block all users from issuing even the most simple commands, such as `ls`. A more patriotic list of rules might be:

    # ugidfw set 2 subject uid user1 object uid user2 mode n
    # ugidfw set 3 subject uid user1 object gid user2 mode n

This will block any and all access, including directory listings, to ``user2``'s home directory from the username `user1`.

In place of `user1`, the `not uid `user2`` could be passed. This will enforce the same access restrictions above for all users in place of just one user.

> Σημείωση: The `root` user will be unaffected by these changes.

This should provide a general idea of how the mac_bsdextended(4) module may be used to help fortify a file system. For more information, see the mac_bsdextended(4) and the ugidfw(8) manual pages.

Προηγ | Αρχή | Επόμενο
Module Configuration | Πάνω | The MAC ifoff Module

Αυτό το κείμενο, και άλλα κείμενα, μπορεί να βρεθεί στο ftp://ftp.FreeBSD.org/pub/FreeBSD/doc/.

Για ερωτήσεις σχετικά με το FreeBSD, διαβάστε την τεκμηρίωση πριν να επικοινωνήσετε με την <questions@FreeBSD.org>.
Για ερωτήσεις σχετικά με αυτή την τεκμηρίωση, στείλτε e-mail στην <doc@FreeBSD.org>.