mac(4): Mention mac_do(4)

Mention also mac_do(4) in the mac(4) manual page.

Reviewed by: bapt
Differential Revision: https://reviews.freebsd.org/D48255

Remove $FreeBSD$: two-line nroff pattern

Remove /^\.\\"\n\.\\"\s*\$FreeBSD\$$\n/

mac_ipacl: new MAC policy module to limit jail/vnet IP configuration

The mac_ipacl policy module enables fine-grained control over IP address
configuration within VNET jails from the base system.
It

mac_ipacl: new MAC policy module to limit jail/vnet IP configuration

The mac_ipacl policy module enables fine-grained control over IP address
configuration within VNET jails from the base system.
It allows the root user to define rules governing IP addresses for
jails and their interfaces using the sysctl interface.

Requested by: multiple
Sponsored by: Google, Inc. (GSoC 2019)
MFC after: 2 months
Reviewed by: bz, dch (both earlier versions)
Differential Revision: https://reviews.freebsd.org/D20967

show more ...

mac(4): update the references to MAC modules

Add entries for mac_ntpd(4) and mac_priority(4) to the table of MAC
modules.

Drop the entry for mac_none(4) from the list, but retain the
cross-referenc

mac(4): update the references to MAC modules

Add entries for mac_ntpd(4) and mac_priority(4) to the table of MAC
modules.

Drop the entry for mac_none(4) from the list, but retain the
cross-reference in SEE ALSO. This module has no functional impact and is
of minimal interest to users. Add a new cross-reference to the similar
mac_stub(4), limited to SEE ALSO for the same reasoning.

Reviewed by: Pau Amma <pauamma@gundo.com>
MFC after: 3 days
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D40483

show more ...

mac: add new mac_ddb(4) policy

Generally, access to the kernel debugger is considered to be unsafe from
a security perspective since it presents an unrestricted interface to
inspect or modify the sy

mac: add new mac_ddb(4) policy

Generally, access to the kernel debugger is considered to be unsafe from
a security perspective since it presents an unrestricted interface to
inspect or modify the system state, including sensitive data such as
signing keys.

However, having some access to debugger functionality on production
systems may be useful in determining the cause of a panic or hang.
Therefore, it is desirable to have an optional policy which allows
limited use of ddb(4) while disabling the functionality which could
reveal system secrets.

This loadable MAC module allows for the use of some ddb(4) commands
while preventing the execution of others. The commands have been broadly
grouped into three categories:
- Those which are 'safe' and will not emit sensitive data (e.g. trace).
Generally, these commands are deterministic and don't accept
arguments.
- Those which are definitively unsafe (e.g. examine <addr>, search
<addr> <value>)
- Commands which may be safe to execute depending on the arguments
provided (e.g. show thread <addr>).

Safe commands have been flagged as such with the DB_CMD_MEMSAFE flag.

Commands requiring extra validation can provide a function to do so.
For example, 'show thread <addr>' can be used as long as addr can be
checked against the system's list of process structures.

The policy also prevents debugger backends other than ddb(4) from
executing, for example gdb(4).

Reviewed by: markj, pauamma_gundo.com (manpages)
Sponsored by: Juniper Networks, Inc.
Sponsored by: Klara, Inc.
Differential Revision: https://reviews.freebsd.org/D35371

show more ...

sys/*/conf/*, docs: fix links to handbook

While here, fix all links to older en_US.ISO8859-1 documentation
in the src/ tree.

PR: 255026
Reported by: Michael Büker <freebsd@michael-bu

sys/*/conf/*, docs: fix links to handbook

While here, fix all links to older en_US.ISO8859-1 documentation
in the src/ tree.

PR: 255026
Reported by: Michael Büker <freebsd@michael-bueker.de>
Reviewed by: dbaio
Approved by: blackend (mentor), re (gjb)
MFC after: 10 days
Differential Revision: https://reviews.freebsd.org/D30265

show more ...

Merge ^/head r323559 through r325504.

MFhead@r325119

Update several more URLs

- Primarily http -> https
- Primarily FreeBSD project URLs

Finish merging from head, messed up in previous attempt

Catch up with head, primarily for the 1.14.4.0 firmware.

Merge ^/head r285793 through r285923.

Update Capsicum and Mandatory Access Control manual pages
to no longer claim they are experimental.

Reviewed by: rwatson@, wblock@
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential

Update Capsicum and Mandatory Access Control manual pages
to no longer claim they are experimental.

Reviewed by: rwatson@, wblock@
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D2985

show more ...

Update to current version of head.

mdoc: order prologue macros consistently by Dd/Dt/Os

Although groff_mdoc(7) gives another impression, this is the ordering
most widely used and also required by mdocml/mandoc.

Reviewed by: ru
Appro

mdoc: order prologue macros consistently by Dd/Dt/Os

Although groff_mdoc(7) gives another impression, this is the ordering
most widely used and also required by mdocml/mandoc.

Reviewed by: ru
Approved by: philip, ed (mentors)

show more ...

IFH@204581

Use the newly brought %U macro.

mdoc warning fix: Remove a spurious .El request.

MFC after: 3 days

Remove a section on the area of the debugging sysctls used to tune
enforcement.

Approved by: re (rwatson)

Mechanically kill hard sentence breaks and double whitespaces.

Assorted mdoc(7) fixes.

Kill whitespace at EOL.

Approved by: re (blanket)

Document the new mac_portacl(4) policy.

Sponsored by: DARPA, Network Associates Laboratories
Obtained from: TrustedBSD Project

o Improve vocabulary/wording
o Expand on MAC policy enforcement on network interfaces
o Add cross-references to su(1) and setfsmac(8) where appropriate
o Comment out mmap revocation sysctls as they a

o Improve vocabulary/wording
o Expand on MAC policy enforcement on network interfaces
o Add cross-references to su(1) and setfsmac(8) where appropriate
o Comment out mmap revocation sysctls as they are a bit too experimental
o Add the standard BUGS section

Prompted by: rwatson
Sponsored by: DARPA, Network Associates Laboratories

show more ...

Include a section about enabling MAC on UFS2 file systems. UFS1 is
a bit more challenging and will be added later.

Sponsored by: DARPA, Network Associates Laboratories