📄 mac-bsdextended.html

📁 这是很好的学习嵌入式LINUX的文章
💻 HTML
字号:
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta name="generator" content="HTML Tidy, see www.w3.org" /><title>The MAC bsdextended Module</title><meta name="GENERATOR" content="Modular DocBook HTML Stylesheet Version 1.7" /><link rel="HOME" title="FreeBSD 使用手册" href="index.html" /><link rel="UP" title="Mandatory Access Control" href="mac.html" /><link rel="PREVIOUS" title="Module Configuration" href="mac-modules.html" /><link rel="NEXT" title="The MAC ifoff Module" href="mac-ifoff.html" /><link rel="STYLESHEET" type="text/css" href="docbook.css" /><meta http-equiv="Content-Type" content="text/html; charset=GB2312" /></head><body class="SECT1" bgcolor="#FFFFFF" text="#000000" link="#0000FF" vlink="#840084"alink="#0000FF"><div class="NAVHEADER"><table summary="Header navigation table" width="100%" border="0" cellpadding="0"cellspacing="0"><tr><th colspan="3" align="center">FreeBSD 使用手册</th></tr><tr><td width="10%" align="left" valign="bottom"><a href="mac-modules.html"accesskey="P">后退</a></td><td width="80%" align="center" valign="bottom">章 15. Mandatory Access Control</td><td width="10%" align="right" valign="bottom"><a href="mac-ifoff.html"accesskey="N">前进</a></td></tr></table><hr align="LEFT" width="100%" /></div><div class="SECT1"><h1 class="SECT1"><a id="MAC-BSDEXTENDED" name="MAC-BSDEXTENDED">15.6. The MACbsdextended Module</a></h1><p>Module name: <tt class="FILENAME">mac_bsdextended.ko</tt></p><p>Kernel configuration line: <var class="LITERAL">options MAC_BSDEXTENDED</var></p><p>Boot option: <var class="LITERAL">mac_bsdextended_load="YES"</var></p><p>The <span class="CITEREFENTRY"><spanclass="REFENTRYTITLE">mac_bsdextended</span>(4)</span> module enforces the file systemfirewall. This module's policy provides an extension to the standard file systempermissions model, permitting an administrator to create a firewall-like ruleset toprotect files, utilities, and directories in the file system hierarchy.</p><p>The policy may be created using a utility, <span class="CITEREFENTRY"><spanclass="REFENTRYTITLE">ugidfw</span>(8)</span>, that has a syntax similar to that of <spanclass="CITEREFENTRY"><span class="REFENTRYTITLE">ipfw</span>(8)</span>. More tools can bewritten by using the functions in the <span class="CITEREFENTRY"><spanclass="REFENTRYTITLE">libugidfw</span>(3)</span> library.</p><p>Extreme caution should be taken when working with this module; incorrect use couldblock access to certain parts of the file system.</p><div class="SECT2"><h2 class="SECT2"><a id="AEN21968" name="AEN21968">15.6.1. Examples</a></h2><p>After the <span class="CITEREFENTRY"><spanclass="REFENTRYTITLE">mac_bsdextended</span>(4)</span> module has been loaded, thefollowing command may be used to list the current rule configuration:</p><pre class="SCREEN"><samp class="PROMPT">#</samp> <kbd class="USERINPUT">ugidfw list</kbd>0 slots, 0 rules</pre><p>As expected, there are no rules defined. This means that everything is stillcompletely accessible. To create a rule which will block all access by users but leave<tt class="USERNAME">root</tt> unaffected, simply run the following command:</p><pre class="SCREEN"><samp class="PROMPT">#</samp> <kbdclass="USERINPUT">ugidfw add subject not uid root new object not uid root mode n</kbd></pre><p>This is a very bad idea as it will block all users from issuing even the most simplecommands, such as <tt class="COMMAND">ls</tt>. A more patriotic list of rules mightbe:</p><pre class="SCREEN"><samp class="PROMPT">#</samp> <kbd class="USERINPUT">ugidfw set 2 subject uid <varclass="REPLACEABLE">user1</var> object uid <varclass="REPLACEABLE">user2</var> mode n</kbd><samp class="PROMPT">#</samp> <kbd class="USERINPUT">ugidfw set 3 subject uid <varclass="REPLACEABLE">user1</var> object gid <varclass="REPLACEABLE">user2</var> mode n</kbd></pre><p>This will block any and all access, including directory listings, to <ttclass="USERNAME"><var class="REPLACEABLE">user2</var></tt>'s home directory from theusername <tt class="USERNAME">user1</tt>.</p><p>In place of <tt class="USERNAME">user1</tt>, the <var class="OPTION">not uid <varclass="REPLACEABLE">user2</var></var> could be passed. This will enforce the same accessrestrictions above for all users in place of just one user.</p><div class="NOTE"><blockquote class="NOTE"><p><b>注:</b> The <tt class="USERNAME">root</tt> user will be unaffected by thesechanges.</p></blockquote></div><p>This should give a general idea of how the <span class="CITEREFENTRY"><spanclass="REFENTRYTITLE">mac_bsdextended</span>(4)</span> module may be used to help fortifya file system. For more information, see the <span class="CITEREFENTRY"><spanclass="REFENTRYTITLE">mac_bsdextended</span>(4)</span> and the <spanclass="CITEREFENTRY"><span class="REFENTRYTITLE">ugidfw</span>(8)</span> manualpages.</p></div></div><div class="NAVFOOTER"><hr align="LEFT" width="100%" /><table summary="Footer navigation table" width="100%" border="0" cellpadding="0"cellspacing="0"><tr><td width="33%" align="left" valign="top"><a href="mac-modules.html"accesskey="P">后退</a></td><td width="34%" align="center" valign="top"><a href="index.html"accesskey="H">起点</a></td><td width="33%" align="right" valign="top"><a href="mac-ifoff.html"accesskey="N">前进</a></td></tr><tr><td width="33%" align="left" valign="top">Module Configuration</td><td width="34%" align="center" valign="top"><a href="mac.html"accesskey="U">上一级</a></td><td width="33%" align="right" valign="top">The MAC ifoff Module</td></tr></table></div></body></html>
⌨️ 快捷键说明

复制代码 Ctrl + C
搜索代码 Ctrl + F
全屏模式 F11
切换主题 Ctrl + Shift + D
显示快捷键 ?
增大字号 Ctrl + =
减小字号 Ctrl + -