1*287d467cSMitchell Horne.\" Copyright (c) 2022 Klara Systems 2*287d467cSMitchell Horne.\" 3*287d467cSMitchell Horne.\" This software was developed by Mitchell Horne <mhorne@FreeBSD.org> 4*287d467cSMitchell Horne.\" under sponsorship from Juniper Networks and Klara Systems. 5*287d467cSMitchell Horne.\" 6*287d467cSMitchell Horne.\" Redistribution and use in source and binary forms, with or without 7*287d467cSMitchell Horne.\" modification, are permitted provided that the following conditions 8*287d467cSMitchell Horne.\" are met: 9*287d467cSMitchell Horne.\" 1. Redistributions of source code must retain the above copyright 10*287d467cSMitchell Horne.\" notice, this list of conditions and the following disclaimer. 11*287d467cSMitchell Horne.\" 2. Redistributions in binary form must reproduce the above copyright 12*287d467cSMitchell Horne.\" notice, this list of conditions and the following disclaimer in the 13*287d467cSMitchell Horne.\" documentation and/or other materials provided with the distribution. 14*287d467cSMitchell Horne.\" 15*287d467cSMitchell Horne.\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND 16*287d467cSMitchell Horne.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 17*287d467cSMitchell Horne.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 18*287d467cSMitchell Horne.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE 19*287d467cSMitchell Horne.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 20*287d467cSMitchell Horne.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 21*287d467cSMitchell Horne.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 22*287d467cSMitchell Horne.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 23*287d467cSMitchell Horne.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 24*287d467cSMitchell Horne.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 25*287d467cSMitchell Horne.\" SUCH DAMAGE. 26*287d467cSMitchell Horne.\" 27*287d467cSMitchell Horne.Dd June 29, 2022 28*287d467cSMitchell Horne.Dt MAC_DDB 4 29*287d467cSMitchell Horne.Os 30*287d467cSMitchell Horne.Sh NAME 31*287d467cSMitchell Horne.Nm mac_ddb 32*287d467cSMitchell Horne.Nd "Restricted kernel debugger interface policy" 33*287d467cSMitchell Horne.Sh SYNOPSIS 34*287d467cSMitchell HorneTo compile the ddb policy 35*287d467cSMitchell Horneinto your kernel, place the following lines in your kernel 36*287d467cSMitchell Horneconfiguration file: 37*287d467cSMitchell Horne.Bd -ragged -offset indent 38*287d467cSMitchell Horne.Cd "options MAC" 39*287d467cSMitchell Horne.Cd "options MAC_DDB" 40*287d467cSMitchell Horne.Ed 41*287d467cSMitchell Horne.Pp 42*287d467cSMitchell HorneAlternately, to load the ddb module at boot time, place the following line 43*287d467cSMitchell Hornein your kernel configuration file: 44*287d467cSMitchell Horne.Bd -ragged -offset indent 45*287d467cSMitchell Horne.Cd "options MAC" 46*287d467cSMitchell Horne.Ed 47*287d467cSMitchell Horne.Pp 48*287d467cSMitchell Horneand in 49*287d467cSMitchell Horne.Xr loader.conf 5 : 50*287d467cSMitchell Horne.Bd -literal -offset indent 51*287d467cSMitchell Hornemac_ddb_load="YES" 52*287d467cSMitchell Horne.Ed 53*287d467cSMitchell Horne.Sh DESCRIPTION 54*287d467cSMitchell HorneThe 55*287d467cSMitchell Horne.Nm 56*287d467cSMitchell Hornepolicy module implements a MAC policy which restricts the set of commands that 57*287d467cSMitchell Hornecan be used at the 58*287d467cSMitchell Horne.Xr ddb 4 59*287d467cSMitchell Hornecommand prompt. 60*287d467cSMitchell HorneThe subset of permitted commands is limited to those which do not read or write 61*287d467cSMitchell Horneto arbitrary memory locations. 62*287d467cSMitchell HorneThis is done to deter the possible extraction of system secrets while still 63*287d467cSMitchell Horneallowing enough debugger functionality to diagnose a kernel panic. 64*287d467cSMitchell HorneFor example, the 65*287d467cSMitchell Horne.Ic trace 66*287d467cSMitchell Horneor 67*287d467cSMitchell Horne.Ic show registers 68*287d467cSMitchell Hornecommands are allowed by this policy, but 69*287d467cSMitchell Horne.Ic show Cm buffer Ar addr 70*287d467cSMitchell Horneis not. 71*287d467cSMitchell Horne.Pp 72*287d467cSMitchell HorneAll debugger commands that are declared with the 73*287d467cSMitchell Horne.Va DB_CMD_MEMSAFE 74*287d467cSMitchell Horneflag are allowed by 75*287d467cSMitchell Horne.Nm . 76*287d467cSMitchell HorneThe policy provides validation functions to conditionally allow some additional 77*287d467cSMitchell Hornecommands, based on the user provided arguments. 78*287d467cSMitchell Horne.Pp 79*287d467cSMitchell HorneWhen loaded, the 80*287d467cSMitchell Horne.Nm 81*287d467cSMitchell Hornepolicy also ensures that only the 82*287d467cSMitchell Horne.Xr ddb 4 83*287d467cSMitchell Hornedebugger backend may be executed; 84*287d467cSMitchell Horne.Xr gdb 4 85*287d467cSMitchell Hornemay not. 86*287d467cSMitchell Horne.Ss Label Format 87*287d467cSMitchell HorneNo labels are defined for 88*287d467cSMitchell Horne.Nm . 89*287d467cSMitchell Horne.Sh SEE ALSO 90*287d467cSMitchell Horne.Xr ddb 4 , 91*287d467cSMitchell Horne.Xr mac 4 , 92*287d467cSMitchell Horne.Xr mac_biba 4 , 93*287d467cSMitchell Horne.Xr mac_bsdextended 4 , 94*287d467cSMitchell Horne.Xr mac_ifoff 4 , 95*287d467cSMitchell Horne.Xr mac_lomac 4 , 96*287d467cSMitchell Horne.Xr mac_mls 4 , 97*287d467cSMitchell Horne.Xr mac_none 4 , 98*287d467cSMitchell Horne.Xr mac_partition 4 , 99*287d467cSMitchell Horne.Xr mac_portacl 4 , 100*287d467cSMitchell Horne.Xr mac_seeotheruids 4 , 101*287d467cSMitchell Horne.Xr mac_test 4 , 102*287d467cSMitchell Horne.Xr mac 9 103*287d467cSMitchell Horne.Sh BUGS 104*287d467cSMitchell HorneWhile the MAC Framework design is intended to support the containment of 105*287d467cSMitchell Hornethe root user, not all attack channels are currently protected by entry 106*287d467cSMitchell Hornepoint checks. 107*287d467cSMitchell HorneAs such, MAC Framework policies should not be relied on, in isolation, 108*287d467cSMitchell Horneto protect against a malicious privileged user. 109