1#!/bin/sh 2# 3# Copyright (c) 2004 Tom Rhodes 4# All rights reserved. 5# 6# Redistribution and use in source and binary forms, with or without 7# modification, are permitted provided that the following conditions 8# are met: 9# 1. Redistributions of source code must retain the above copyright 10# notice, this list of conditions and the following disclaimer. 11# 2. Redistributions in binary form must reproduce the above copyright 12# notice, this list of conditions and the following disclaimer in the 13# documentation and/or other materials provided with the distribution. 14# 15# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 16# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 17# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 18# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 19# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 20# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 21# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 22# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 23# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 24# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 25# SUCH DAMAGE. 26# 27# 28 29#### 30# Sample startup policy for the mac_bsdextended(4) security module. 31# 32# Suck in the system configuration variables. 33#### 34if [ -z "${source_rc_confs_defined}" ]; then 35 if [ -r /etc/defaults/rc.conf ]; then 36 . /etc/defaults/rc.conf 37 source_rc_confs 38 elif [ -r /etc/rc.conf ]; then 39 . /etc/rc.conf 40 fi 41fi 42 43#### 44# Set ugidfw(8) to CMD: 45#### 46CMD=/usr/sbin/ugidfw 47 48#### 49# WARNING: recommended reading is the handbook's MAC 50# chapter and the ugidfw(8) manual page. You can 51# lock yourself out of the system very quickly by setting 52# incorrect values here. These are only examples. 53#### 54 55#### 56# Build a generic list of rules here, these should be 57# modified before using this script. 58# 59# For apache to read user files, the ruleadd must give 60# it permissions by default. 61#### 62#${CMD} add subject uid 80 object not uid 80 mode rxws; 63#${CMD} add subject gid 80 object not gid 80 mode rxws; 64 65#### 66# majordomo compat: 67#${CMD} add subject uid 54 object not uid 54 mode rxws; 68#${CMD} add subject gid 26 object gid 54 mode rxws; 69 70#### 71# This is for root: 72${CMD} add subject uid 0 object not uid 0 mode arxws; 73${CMD} add subject gid 0 object not gid 0 mode arxws; 74 75#### 76# And for majordomo: 77#${CMD} add subject uid 54 object not uid 54 mode rxws; 78#${CMD} add subject gid 54 object not gid 54 mode rxws; 79 80#### 81# And for bin: 82${CMD} add subject uid 3 object not uid 3 mode rxws; 83${CMD} add subject gid 7 object not gid 7 mode rxws; 84 85#### 86# And for mail/pop: 87#${CMD} add subject uid 68 object not uid 68 mode rxws; 88#${CMD} add subject gid 6 object not gid 6 mode arxws; 89 90#### 91# And for smmsp: 92${CMD} add subject uid 25 object not uid 25 mode rxws; 93${CMD} add subject gid 25 object not gid 25 mode rxws; 94 95#### 96# And for mailnull: 97${CMD} add subject uid 26 object not uid 26 mode rxws; 98${CMD} add subject gid 26 object not gid 26 mode rxws; 99 100#### 101# For cyrus: 102#${CMD} add subject uid 60 object not uid 60 mode rxws; 103#${CMD} add subject gid 60 object not gid 60 mode rxws; 104 105#### 106# For stunnel: 107#${CMD} add subject uid 1018 object not uid 1018 mode rxws; 108#${CMD} add subject gid 1018 object not gid 1018 mode rxws; 109 110#### 111# For the nobody account: 112${CMD} add subject uid 65534 object not uid 65534 mode rxws; 113${CMD} add subject gid 65534 object not gid 65534 mode rxws; 114 115#### 116# NOTICE: The next script adds a rule to allow 117# access their mailbox which is owned by GID `6'. 118# Removing this will give mailbox lock issues. 119for x in `awk -F: '($3 >= 1001) && ($3 != 65534) { print $1 }' /etc/passwd`; 120 do ${CMD} add subject uid $x object gid 6 mode arwxs; 121done; 122 123#### 124# Use some script to get a list of users and 125# add all users to mode n for all other users. This 126# will isolate all users from other user home directories while 127# permitting them to use commands and browse the system. 128for x in `awk -F: '($3 >= 1001) && ($3 != 65534) { print $1 }' /etc/passwd`; 129 do ${CMD} add subject not uid $x object uid $x mode n; 130done; 131 132### 133# Do the same thing but only for group ids in place of 134# user IDs. 135for x in `awk -F: '($3 >= 1001) && ($3 != 65534) { print $3 }' /etc/passwd`; 136 do ${CMD} add subject not gid $x object uid $x mode n; 137done; 138