etc/rc.bsdextended

   1 #!/bin/sh
   2 #
   3 # Copyright (c) 2004  Tom Rhodes
   4 # All rights reserved.
   5 #
   6 # Redistribution and use in source and binary forms, with or without
   7 # modification, are permitted provided that the following conditions
   8 # are met:
   9 # 1. Redistributions of source code must retain the above copyright
  10 #    notice, this list of conditions and the following disclaimer.
  11 # 2. Redistributions in binary form must reproduce the above copyright
  12 #    notice, this list of conditions and the following disclaimer in the
  13 #    documentation and/or other materials provided with the distribution.
  14 #
  15 # THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  16 # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  17 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  18 # ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  19 # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  20 # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  21 # OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  22 # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  23 # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  24 # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  25 # SUCH DAMAGE.
  26 #
  27 # $FreeBSD$
  28 #
  29
  30 ####
  31 # Sample startup policy for the mac_bsdextended(4) security module.
  32 #
  33 # Suck in the system configuration variables.
  34 ####
  35 if [ -z "${source_rc_confs_defined}" ]; then
  36         if [ -r /etc/defaults/rc.conf ]; then
  37                 . /etc/defaults/rc.conf
  38                 source_rc_confs
  39         elif [ -r /etc/rc.conf ]; then
  40                 . /etc/rc.conf
  41         fi
  42 fi
  43
  44 ####
  45 # Set ugidfw(8) to CMD:
  46 ####
  47 CMD=/usr/sbin/ugidfw
  48
  49 ####
  50 # WARNING: recommended reading is the handbook's MAC
  51 # chapter and the ugidfw(8) manual page.  You can
  52 # lock yourself out of the system very quickly by setting
  53 # incorrect values here.  These are only examples.
  54 ####
  55
  56 ####
  57 # Build a generic list of rules here, these should be
  58 # modified before using this script.
  59 #
  60 # For apache to read user files, the ruleadd must give
  61 # it permissions by default.
  62 ####
  63 #${CMD} add subject uid 80 object not uid 80 mode rxws;
  64 #${CMD} add subject gid 80 object not gid 80 mode rxws;
  65
  66 ####
  67 # majordomo compat:
  68 #${CMD} add subject uid 54 object not uid 54 mode rxws;
  69 #${CMD} add subject gid 26 object gid 54 mode rxws;
  70
  71 ####
  72 # This is for root:
  73 ${CMD} add subject uid 0 object not uid 0 mode arxws;
  74 ${CMD} add subject gid 0 object not gid 0 mode arxws;
  75
  76 ####
  77 # And for majordomo:
  78 #${CMD} add subject uid 54 object not uid 54 mode rxws;
  79 #${CMD} add subject gid 54 object not gid 54 mode rxws;
  80
  81 ####
  82 # And for bin:
  83 ${CMD} add subject uid 3 object not uid 3 mode rxws;
  84 ${CMD} add subject gid 7 object not gid 7 mode rxws;
  85
  86 ####
  87 # And for mail/pop:
  88 #${CMD} add subject uid 68 object not uid 68 mode rxws;
  89 #${CMD} add subject gid 6 object not gid 6 mode arxws;
  90
  91 ####
  92 # And for smmsp:
  93 ${CMD} add subject uid 25 object not uid 25 mode rxws;
  94 ${CMD} add subject gid 25 object not gid 25 mode rxws;
  95
  96 ####
  97 # And for mailnull:
  98 ${CMD} add subject uid 26 object not uid 26 mode rxws;
  99 ${CMD} add subject gid 26 object not gid 26 mode rxws;
 100
 101 ####
 102 # For cyrus:
 103 #${CMD} add subject uid 60 object not uid 60 mode rxws;
 104 #${CMD} add subject gid 60 object not gid 60 mode rxws;
 105
 106 ####
 107 # For stunnel:
 108 #${CMD} add subject uid 1018 object not uid 1018 mode rxws;
 109 #${CMD} add subject gid 1018 object not gid 1018 mode rxws;
 110
 111 ####
 112 # For the nobody account:
 113 ${CMD} add subject uid 65534 object not uid 65534 mode rxws;
 114 ${CMD} add subject gid 65534 object not gid 65534 mode rxws;
 115
 116 ####
 117 # NOTICE: The next script adds a rule to allow
 118 #        access their mailbox which is owned by GID `6'.
 119 #        Removing this will give mailbox lock issues.
 120 for x in `awk -F: '($3 >= 1001) && ($3 != 65534) { print $1 }' /etc/passwd`;
 121     do ${CMD} add subject uid $x object gid 6 mode arwxs;
 122 done;
 123
 124 ####
 125 # Use some script to get a list of users and
 126 # add all users to mode n for all other users.  This
 127 # will isolate all users from other user home directories while
 128 # permitting them to use commands and browse the system.
 129 for x in `awk -F: '($3 >= 1001) && ($3 != 65534) { print $1 }' /etc/passwd`;
 130     do ${CMD} add subject not uid $x object uid $x mode n;
 131 done;
 132
 133 ###
 134 # Do the same thing but only for group ids in place of
 135 # user IDs.
 136 for x in `awk -F: '($3 >= 1001) && ($3 != 65534) { print $3 }' /etc/passwd`;
 137     do ${CMD} add subject not gid $x object uid $x mode n;
 138 done;