1#!/bin/sh 2# 3# Copyright (c) 2004 Tom Rhodes 4# All rights reserved. 5# 6# Redistribution and use in source and binary forms, with or without 7# modification, are permitted provided that the following conditions 8# are met: 9# 1. Redistributions of source code must retain the above copyright 10# notice, this list of conditions and the following disclaimer. 11# 2. Redistributions in binary form must reproduce the above copyright 12# notice, this list of conditions and the following disclaimer in the 13# documentation and/or other materials provided with the distribution. 14# 15# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 16# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 17# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 18# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 19# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 20# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 21# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 22# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 23# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 24# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 25# SUCH DAMAGE. 26# 27# $FreeBSD$ 28# 29 30#### 31# Sample startup policy for the mac_bsdextended(4) security module. 32# 33# Suck in the system configuration variables. 34#### 35if [ -z "${source_rc_confs_defined}" ]; then 36 if [ -r /etc/defaults/rc.conf ]; then 37 . /etc/defaults/rc.conf 38 source_rc_confs 39 elif [ -r /etc/rc.conf ]; then 40 . /etc/rc.conf 41 fi 42fi 43 44#### 45# Set ugidfw(8) to CMD: 46#### 47CMD=/usr/sbin/ugidfw 48 49#### 50# WARNING: recommended reading is the handbook's MAC 51# chapter and the ugidfw(8) manual page. You can 52# lock yourself out of the system very quickly by setting 53# incorrect values here. These are only examples. 54#### 55 56#### 57# Build a generic list of rules here, these should be 58# modified before using this script. 59# 60# For apache to read user files, the ruleadd must give 61# it permissions by default. 62#### 63#${CMD} add subject uid 80 object not uid 80 mode rxws; 64#${CMD} add subject gid 80 object not gid 80 mode rxws; 65 66#### 67# majordomo compat: 68#${CMD} add subject uid 54 object not uid 54 mode rxws; 69#${CMD} add subject gid 26 object gid 54 mode rxws; 70 71#### 72# This is for root: 73${CMD} add subject uid 0 object not uid 0 mode arxws; 74${CMD} add subject gid 0 object not gid 0 mode arxws; 75 76#### 77# And for majordomo: 78#${CMD} add subject uid 54 object not uid 54 mode rxws; 79#${CMD} add subject gid 54 object not gid 54 mode rxws; 80 81#### 82# And for bin: 83${CMD} add subject uid 3 object not uid 3 mode rxws; 84${CMD} add subject gid 7 object not gid 7 mode rxws; 85 86#### 87# And for mail/pop: 88#${CMD} add subject uid 68 object not uid 68 mode rxws; 89#${CMD} add subject gid 6 object not gid 6 mode arxws; 90 91#### 92# And for smmsp: 93${CMD} add subject uid 25 object not uid 25 mode rxws; 94${CMD} add subject gid 25 object not gid 25 mode rxws; 95 96#### 97# And for mailnull: 98${CMD} add subject uid 26 object not uid 26 mode rxws; 99${CMD} add subject gid 26 object not gid 26 mode rxws; 100 101#### 102# For cyrus: 103#${CMD} add subject uid 60 object not uid 60 mode rxws; 104#${CMD} add subject gid 60 object not gid 60 mode rxws; 105 106#### 107# For stunnel: 108#${CMD} add subject uid 1018 object not uid 1018 mode rxws; 109#${CMD} add subject gid 1018 object not gid 1018 mode rxws; 110 111#### 112# For the nobody account: 113${CMD} add subject uid 65534 object not uid 65534 mode rxws; 114${CMD} add subject gid 65534 object not gid 65534 mode rxws; 115 116#### 117# NOTICE: The next script adds a rule to allow 118# access their mailbox which is owned by GID `6'. 119# Removing this will give mailbox lock issues. 120for x in `awk -F: '($3 >= 1001) && ($3 != 65534) { print $1 }' /etc/passwd`; 121 do ${CMD} add subject uid $x object gid 6 mode arwxs; 122done; 123 124#### 125# Use some script to get a list of users and 126# add all users to mode n for all other users. This 127# will isolate all users from other user home directories while 128# permitting them to use commands and browse the system. 129for x in `awk -F: '($3 >= 1001) && ($3 != 65534) { print $1 }' /etc/passwd`; 130 do ${CMD} add subject not uid $x object uid $x mode n; 131done; 132 133### 134# Do the same thing but only for group ids in place of 135# user IDs. 136for x in `awk -F: '($3 >= 1001) && ($3 != 65534) { print $3 }' /etc/passwd`; 137 do ${CMD} add subject not gid $x object uid $x mode n; 138done; 139