The next few sections will discuss MAC policies which use labels.
From here on this chapter will focus on the features of mac_biba(4), mac_lomac(4), mac_partition(4), and mac_mls(4).
This is an example configuration only and should not be considered for a production implementation. The goal is to document and show the syntax as well as examples for implementation and testing.
For these policies to work correctly several preparations must be made.
The following changes are required in the
login.conf
file:
An insecure
class, or another
class of similar type, must be
added. The login class of insecure
is not required and just used as an example here; different
configurations may use another class name.
The insecure
class should have
the following settings and definitions. Several of these
can be altered but the line which defines the default
label is a requirement and must remain.
The cap_mkdb(1) command needs to be ran on login.conf(5) before any of the users can be switched over to the new class.
The root
username should also be placed
into a login class; otherwise, almost every command
executed by root
will require the
use of setpmac
.
Rebuilding the login.conf
database may cause some errors later with the daemon
class. Simply uncommenting the daemon account and
rebuilding the database should alleviate these
issues.
Ensure that all partitions on which
MAC labeling will be implemented support
the multilabel
. We must do this because
many of the examples here contain different labels for
testing purposes. Review the output from the
mount
command as a precautionary
measure.
Switch any users who will have the higher security mechanisms enforced over to the new user class. A quick run of pw(8) or vipw(8) should do the trick.
本文及其他文件,可由此下載: ftp://ftp.FreeBSD.org/pub/FreeBSD/doc/。
若有 FreeBSD 方面疑問,請先閱讀
FreeBSD 相關文件,如不能解決的話,再洽詢
<questions@FreeBSD.org>。
關於本文件的問題,請洽詢
<doc@FreeBSD.org>。