Page MenuHomeFreeBSD
Files F169733759

D58017.id181834.diff
No OneTemporary
Actions

D58017.id181834.diff
View Options

diff --git a/share/man/man4/mac_do.4 b/share/man/man4/mac_do.4
--- a/share/man/man4/mac_do.4
+++ b/share/man/man4/mac_do.4
@@ -58,7 +58,7 @@
.Sx CONFIGURATION
explains how to configure
.Nm ,
-including rules and authorized executables.
+including rules and trusted binaries.
.Sh CREDENTIALS RULES
Rules specify which transitions of process credentials
.Nm
@@ -80,14 +80,18 @@
One rule is composed of a
.Li Aq from
part
-.Pq also called Dq match
-and a
+.Pq also called Dq match ,
+a
.Li Aq to
part
-.Pq also called Dq target ,
+.Pq also called Dq target
+and an optional
+.Li Aq exec_list
+part
+.Pq also called Dq exec_constraint ,
in this order, separated by a greater-than sign
.Pq Ql > :
-.Dl Ao rule Ac \ ⟶\ Ao from Ac So > Sc Ao to Ac
+.Dl Ao rule Ac \ ⟶\ Ao from Ac So > Sc Ao to Ac Oo Ao exec_list Ac Oc
.Ss Rule's Ao from Ac Part
The first part of a rule,
.Li Aq from ,
@@ -263,6 +267,47 @@
and
.Ql -
will cause rejection of the rule.
+.Ss Rule's Ao exec_list Ac Part
+An optional part of the rule,
+.Li Aq exec_list ,
+is a colon-separated
+.Pq Ql ":"
+list of absolute paths of programs to be spawned by executables such as mdo,
+the syntax of
+.Li Aq exec_list
+is as follow:
+.D1 Ao exec_list Ac \ ⟶\ So Pf ( Sc exec= Sc Oo "!" Oc Ao exec_path Ac Oo
+.So ":" Sc Ao exec_path Ac Oc | * So ) Sc
+.Pp
+the meaning of each of the tokens is as follow:
+.Bl -bullet
+.It
+.Li the Aq exec_list
+tokens must always be enclosed in parenthesis
+.Ql Pf ()
+.It
+.Li Dq exec=
+must always be specified before the list of paths or the literal
+.Ql *
+.It
+.Ql Pf !
+is a special literal which makes the
+.Li Aq exec_list
+work as a blacklist acting opposite of the default behaviour of a whitelist
+allowing mdo and similar executables to spawn processes for every command except
+for those that match the paths in
+.Li Aq exec_path
+.It
+.Li Aq exec_path
+is the absolute path of the program to be allowed to spawn processes for by
+mdo and similar executables where the list of paths is colon-separated
+.Pq Ql ":"
+.It
+specifying the
+.Ql *
+literal gives the same result as not specifying the
+.Li Aq exec_list
+field.
.Ss Parsing Specifics
Any amount of whitespace is allowed around tokens of the above grammar, except
that there may be no spaces between
@@ -321,14 +366,16 @@
section above.
An empty string effectively disables the policy.
.Pq Per-jail. Default: Empty.
-.It Va security.mac.do.exec_paths
+.It Va security.mac.do.trusted_bins
The list of absolute paths
.Pq relative to the current jail's root
-to authorized executables, separated by colons
+to trusted binaries, separated by colons
.Pq Ql ":" .
-Only processes launched from these executables are considered by the
+Only these binaries are considered by the
.Nm
-policy.
+policy and allowed to call
+.Xr setcred 2
+to change credentials.
An empty string effectively disables the policy.
.Po
Per-jail. Default:
@@ -381,7 +428,7 @@
This is achieved by ensuring that at least one of the
.Va mac.do.rules
and
-.Va mac.do.exec_paths
+.Va mac.do.trusted_bins
jail parameters are empty.
If none of them ends up empty after applying the default values rule
.Pq see the preamble ,
@@ -419,12 +466,12 @@
.Sx "Sysctl Knobs"
above.
See also the preamble for the default values rule.
-.It Va mac.do.exec_paths
-The authorized executables.
+.It Va mac.do.trusted_bins
+The trusted binaries.
See the description of the corresponding
.Xr sysctl 8
knob
-.Va security.mac.do.exec_paths
+.Va security.mac.do.trusted_bins
in subsection
.Sx "Sysctl Knobs"
above.
@@ -492,6 +539,24 @@
Same as the previous example, but with the additional constraint that all
current supplementary groups must be kept.
.El
+.Pp
+Here are some examples of rules using the exec_constraint:
+.Bl -tag -width indent
+.It Li uid=10001>uid=0(exec=/usr/bin/id:/usr/bin/whoami:/usr/bin/top)
+Allows the process to become root but only to run top, whoami and id
+.It Li uid=10001>uid=0(exec=/usr/bin/id);uid=10001>uid=10002(exec=/usr/bin/id:/usr/bin/vi)
+Allows the process to become root but only to run id or become user with UID 10002 but
+only to run vi or id
+.It Li uid=1001>uid=0(exec=*)
+Allows the process to become root to run any command,same as omitting the
+.Li Aq exec_list
+field in the rule
+.It Li uid=1001>uid=0(exec=!/bin/sh:/bin/csh:/usr/local/bin/bash)
+Here the
+.Sq Pf !
+literal acts as a blacklist allowing the process to become root to run any
+commands except sh, csh and bash
+.El
.Sh SEE ALSO
.Xr mdo 1 ,
.Xr setcred 2 ,

File Metadata

Mime Type
text/plain
Expires
Thu, Sep 3, 10:10 AM (4 h, 13 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
35035712
Default Alt Text
D58017.id181834.diff (4 KB)

Event Timeline