1*cba191e2SOlivier Certner# 2*cba191e2SOlivier Certner# Copyright (c) 2026, The FreeBSD Foundation 3*cba191e2SOlivier Certner# 4*cba191e2SOlivier Certner# This software was developed by Olivier Certner <olce@FreeBSD.org> at 5*cba191e2SOlivier Certner# Kumacom SARL under sponsorship from the FreeBSD Foundation. 6*cba191e2SOlivier Certner 7*cba191e2SOlivier Certnerrules_parameter() 8*cba191e2SOlivier Certner{ 9*cba191e2SOlivier Certner echo "$1".rules 10*cba191e2SOlivier Certner} 11*cba191e2SOlivier Certner 12*cba191e2SOlivier Certner 13*cba191e2SOlivier CertnerCONF_ROOT_KNOB=security.mac.do 14*cba191e2SOlivier CertnerRULES_KNOB=$(rules_parameter ${CONF_ROOT_KNOB}) 15*cba191e2SOlivier CertnerPPE_KNOB=${CONF_ROOT_KNOB}.print_parse_error 16*cba191e2SOlivier Certner 17*cba191e2SOlivier Certner 18*cba191e2SOlivier Certner# $1 = knob name, $2 = value 19*cba191e2SOlivier Certnersysctl_set_and_check() 20*cba191e2SOlivier Certner{ 21*cba191e2SOlivier Certner local knob value 22*cba191e2SOlivier Certner 23*cba191e2SOlivier Certner knob=$1 24*cba191e2SOlivier Certner value=$2 25*cba191e2SOlivier Certner atf_check -o ignore sysctl "$knob"="$value" 26*cba191e2SOlivier Certner atf_check -o inline:"$value\n" sysctl -n "$knob" 27*cba191e2SOlivier Certner} 28*cba191e2SOlivier Certner 29*cba191e2SOlivier Certner# $1 = knob name, $2 = value 30*cba191e2SOlivier Certnersysctl_set_and_check_fails() 31*cba191e2SOlivier Certner{ 32*cba191e2SOlivier Certner local knob value orig_value 33*cba191e2SOlivier Certner 34*cba191e2SOlivier Certner knob=$1 35*cba191e2SOlivier Certner value=$2 36*cba191e2SOlivier Certner orig_value=$(sysctl -n "$knob") 37*cba191e2SOlivier Certner atf_check -s not-exit:0 -o ignore -e ignore sysctl "$knob"="$value" 38*cba191e2SOlivier Certner atf_check -o inline:"${orig_value}\n" sysctl -n "$knob" 39*cba191e2SOlivier Certner} 40*cba191e2SOlivier Certner 41*cba191e2SOlivier Certner# $1 = sysctl function, $2 = value 42*cba191e2SOlivier Certnersysctl_set_and_check_rules_common() 43*cba191e2SOlivier Certner{ 44*cba191e2SOlivier Certner local func value 45*cba191e2SOlivier Certner 46*cba191e2SOlivier Certner func=$1 47*cba191e2SOlivier Certner value=$2 48*cba191e2SOlivier Certner "$func" ${RULES_KNOB} "$value" 49*cba191e2SOlivier Certner # Same spec but using the older in-rule separator (':') 50*cba191e2SOlivier Certner "$func" ${RULES_KNOB} "$(echo "$value" | sed 's%>%:%')" 51*cba191e2SOlivier Certner} 52*cba191e2SOlivier Certner 53*cba191e2SOlivier Certner# $1 = value 54*cba191e2SOlivier Certnersysctl_set_and_check_rules() 55*cba191e2SOlivier Certner{ 56*cba191e2SOlivier Certner local value 57*cba191e2SOlivier Certner 58*cba191e2SOlivier Certner value=$1 59*cba191e2SOlivier Certner sysctl_set_and_check_rules_common sysctl_set_and_check "$value" 60*cba191e2SOlivier Certner} 61*cba191e2SOlivier Certner 62*cba191e2SOlivier Certner# $1 = value 63*cba191e2SOlivier Certnersysctl_set_and_check_fails_rules() 64*cba191e2SOlivier Certner{ 65*cba191e2SOlivier Certner local value 66*cba191e2SOlivier Certner 67*cba191e2SOlivier Certner value=$1 68*cba191e2SOlivier Certner sysctl_set_and_check_rules_common sysctl_set_and_check_fails "$value" 69*cba191e2SOlivier Certner} 70*cba191e2SOlivier Certner 71*cba191e2SOlivier Certner# Do not pollute kernel logs with parse errors 72*cba191e2SOlivier Certnersysctl $PPE_KNOB=0 >/dev/null 2>&1 73