3 # Copyright (c) 2004 Tom Rhodes
6 # Redistribution and use in source and binary forms, with or without
7 # modification, are permitted provided that the following conditions
9 # 1. Redistributions of source code must retain the above copyright
10 # notice, this list of conditions and the following disclaimer.
11 # 2. Redistributions in binary form must reproduce the above copyright
12 # notice, this list of conditions and the following disclaimer in the
13 # documentation and/or other materials provided with the distribution.
15 # THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16 # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18 # ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19 # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20 # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21 # OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22 # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23 # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24 # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 # Sample startup policy for the mac_bsdextended(4) security module.
33 # Suck in the system configuration variables.
35 if [ -z "${source_rc_confs_defined}" ]; then
36 if [ -r /etc/defaults/rc.conf ]; then
37 . /etc/defaults/rc.conf
39 elif [ -r /etc/rc.conf ]; then
45 # Set ugidfw(8) to CMD:
50 # WARNING: recommended reading is the handbook's MAC
51 # chapter and the ugidfw(8) manual page. You can
52 # lock yourself out of the system very quickly by setting
53 # incorrect values here. These are only examples.
57 # Build a generic list of rules here, these should be
58 # modified before using this script.
60 # For apache to read user files, the ruleadd must give
61 # it permissions by default.
63 #${CMD} add subject uid 80 object not uid 80 mode rxws;
64 #${CMD} add subject gid 80 object not gid 80 mode rxws;
68 #${CMD} add subject uid 54 object not uid 54 mode rxws;
69 #${CMD} add subject gid 26 object gid 54 mode rxws;
73 ${CMD} add subject uid 0 object not uid 0 mode arxws;
74 ${CMD} add subject gid 0 object not gid 0 mode arxws;
78 #${CMD} add subject uid 54 object not uid 54 mode rxws;
79 #${CMD} add subject gid 54 object not gid 54 mode rxws;
83 ${CMD} add subject uid 3 object not uid 3 mode rxws;
84 ${CMD} add subject gid 7 object not gid 7 mode rxws;
88 #${CMD} add subject uid 68 object not uid 68 mode rxws;
89 #${CMD} add subject gid 6 object not gid 6 mode arxws;
93 ${CMD} add subject uid 25 object not uid 25 mode rxws;
94 ${CMD} add subject gid 25 object not gid 25 mode rxws;
98 ${CMD} add subject uid 26 object not uid 26 mode rxws;
99 ${CMD} add subject gid 26 object not gid 26 mode rxws;
103 #${CMD} add subject uid 60 object not uid 60 mode rxws;
104 #${CMD} add subject gid 60 object not gid 60 mode rxws;
108 #${CMD} add subject uid 1018 object not uid 1018 mode rxws;
109 #${CMD} add subject gid 1018 object not gid 1018 mode rxws;
112 # For the nobody account:
113 ${CMD} add subject uid 65534 object not uid 65534 mode rxws;
114 ${CMD} add subject gid 65534 object not gid 65534 mode rxws;
117 # NOTICE: The next script adds a rule to allow
118 # access their mailbox which is owned by GID `6'.
119 # Removing this will give mailbox lock issues.
120 for x in `awk -F: '($3 >= 1001) && ($3 != 65534) { print $1 }' /etc/passwd`;
121 do ${CMD} add subject uid $x object gid 6 mode arwxs;
125 # Use some script to get a list of users and
126 # add all users to mode n for all other users. This
127 # will isolate all users from other user home directories while
128 # permitting them to use commands and browse the system.
129 for x in `awk -F: '($3 >= 1001) && ($3 != 65534) { print $1 }' /etc/passwd`;
130 do ${CMD} add subject not uid $x object uid $x mode n;
134 # Do the same thing but only for group ids in place of
136 for x in `awk -F: '($3 >= 1001) && ($3 != 65534) { print $3 }' /etc/passwd`;
137 do ${CMD} add subject not gid $x object uid $x mode n;