3 # Copyright (c) 2004 Tom Rhodes
6 # Redistribution and use in source and binary forms, with or without
7 # modification, are permitted provided that the following conditions
9 # 1. Redistributions of source code must retain the above copyright
10 # notice, this list of conditions and the following disclaimer.
11 # 2. Redistributions in binary form must reproduce the above copyright
12 # notice, this list of conditions and the following disclaimer in the
13 # documentation and/or other materials provided with the distribution.
15 # THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16 # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18 # ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19 # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20 # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21 # OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22 # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23 # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24 # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 # Sample startup policy for the mac_bsdextended(4) security module.
33 # Suck in the system configuration variables.
35 if [ -z "${source_rc_confs_defined}" ]; then
36 if [ -r /etc/defaults/rc.conf ]; then
37 . /etc/defaults/rc.conf
39 elif [ -r /etc/rc.conf ]; then
45 # Set ugidfw(8) to CMD:
50 # WARNING: recommended reading is the handbook's MAC
51 # chapter and the ugidfw(8)
52 # manual page. You can lock yourself out of the system
53 # very quickly by setting incorrect values here.
57 # Set the value of 'x' to system users. This would be nice but it
58 # does not get the \n proper. Work around is used below.
59 #x=`awk -F: '($3 >= 1001) && ($3 != 65534) { print $1 }' /etc/passwd`;
60 #l=`awk -F: '($3 >= 1001) && ($3 != 65534) { print $3 }' /etc/passwd`;
64 # Build a generic list of rules here, these should be
65 # modified before using this script.
66 # ugidfw add 1 subject uid USER1 object uid USER2 mode n
67 # ugidfw add 2 subject gid USER1 object gid USER2 mode n
69 # For apache to read user files, the ruleadd must give
70 # it permissions by default.
72 ${CMD} add subject uid 80 object not uid 80 mode rxws;
73 ${CMD} add subject gid 80 object not gid 80 mode rxws;
77 #${CMD} add subject uid 54 object not uid 54 mode rxws;
78 ${CMD} add subject gid 26 object gid 54 mode rxws;
82 ${CMD} add subject uid 0 object not uid 0 mode arxws;
83 ${CMD} add subject gid 0 object not gid 0 mode arxws;
87 ${CMD} add subject uid 26 object not uid 26 mode rxws;
88 ${CMD} add subject gid 26 object not gid 26 mode rxws;
92 ${CMD} add subject uid 54 object not uid 54 mode rxws;
93 ${CMD} add subject gid 54 object not gid 54 mode rxws;
97 ${CMD} add subject uid 3 object not uid 3 mode rxws;
98 ${CMD} add subject gid 7 object not gid 7 mode rxws;
102 ${CMD} add subject uid 68 object not uid 68 mode rxws;
103 ${CMD} add subject gid 6 object not gid 6 mode arxws;
107 ${CMD} add subject uid 25 object not uid 25 mode rxws;
108 ${CMD} add subject gid 25 object not gid 25 mode rxws;
112 ${CMD} add subject uid 26 object not uid 26 mode rxws;
113 ${CMD} add subject gid 26 object not gid 26 mode rxws;
117 ${CMD} add subject uid 60 object not uid 60 mode rxws;
118 ${CMD} add subject gid 60 object not gid 60 mode rxws;
122 ${CMD} add subject uid 1018 object not uid 1018 mode rxws;
123 ${CMD} add subject gid 1018 object not gid 1018 mode rxws;
126 # For the nobody account:
127 ${CMD} add subject uid 65534 object not uid 65534 mode rxws;
128 ${CMD} add subject gid 65534 object not gid 65534 mode rxws;
131 # NOTICE: The next script adds a rule to allow
132 # access their mailbox which is owned by GID `6'.
133 # Removing this will give mailbox lock issues.
134 for x in `awk -F: '($3 >= 1001) && ($3 != 65534) { print $1 }' /etc/passwd`;
135 do ${CMD} add subject uid $x object gid 6 mode arwxs;
139 # Work around majordomo problem where gid is `4'.
140 for x in `awk -F: '($3 >= 1001) && ($3 != 65534) { print $1 }' /etc/passwd`;
141 do ${CMD} add subject uid $x object gid 4 mode arwxs;
145 # Use some script to get a list of users and
146 # add all users to mode n for all other users. This
147 # will isolate all users from other user home directories while
148 # permitting them to use commands and browse the system.
149 for x in `awk -F: '($3 >= 1001) && ($3 != 65534) { print $1 }' /etc/passwd`;
150 do ${CMD} add subject not uid $x object uid $x mode n;
154 # Do the same thing but only for group ids in place of
156 for x in `awk -F: '($3 >= 1001) && ($3 != 65534) { print $3 }' /etc/passwd`;
157 do ${CMD} add subject not gid $x object uid $x mode n;