Subversion Repositories general

.\" Copyright 2005, Anatoli Klassen <anatoli@aksoft.net>
.\" All rights reserved.
.\"
.\" Redistribution and use in source and binary forms, with or without
.\" modification, are permitted provided that the following conditions
.\" are met:
.\" 1. Redistributions of source code must retain the above copyright
.\"    notice, this list of conditions and the following disclaimer.
.\" 2. Redistributions in binary form must reproduce the above copyright
.\"    notice, this list of conditions and the following disclaimer in the
.\"    documentation and/or other materials provided with the distribution.
.\"
.\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
.\" SUCH DAMAGE.
.\"
.\"
.Dd November 4, 2005
.Dt MAC_SETTIME 4
.Os
.Sh NAME
.Nm mac_settime
.Nd "set system time policy"
.Sh SYNOPSIS
To load the set system time policy module at boot time,
place the following line in your kernel configuration file:
.Bd -ragged -offset indent
.Cd "options MAC"
.Ed
.Pp
and place the following line in
.Xr loader.conf 5 :
.Pp
.Dl "mac_settime_load=""YES"""
.Pp
then compile the module and copy it to your kernel modules directory
(e.g. /boot/kernel or /boot/modules)
.Sh DESCRIPTION
The
.Nm
policy allows administrators to define who is allowed to set and adjust system time.
.Pp
In order to use the
.Nm
policy, the
.Va kern.usersettime
and
.Va kern.useradjtime
.Xr sysctl 8
MIBs should be set to 1 to disable kernel security check.
.Pp
If system time has to be changed from jail, additionaly the
.Va kern.jailsettime
and
.Va kern.jailadjtime
.Xr sysctl 8
MIBs should be set to 1.
.Pp
The following
.Xr sysctl 8
MIBs are available for fine-tuning the enforcement of this MAC policy.
All
.Xr sysctl 8
variables, except
.Va security.mac.portacl.rules ,
can also be set as
.Xr loader 8
tunables in
.Xr loader.conf 5 .
.Bl -tag -width indent
.It Va security.mac.settime.enabled
Enforce the
.Nm
policy.
(Default: 1).
.Pp
The MIB ca alse be set as
.Xr loader 8
tunables in
.Xr loader.conf 5 .
.It Va security.mac.settime.rules
The set time access control list is specified as list of rules, separated by semicolon or new line.
Rules are applied in given order, first match wins.
If no match found time setting is denied.
Each rule has the following format:
.Pp
.D1 Ar action Oo not Oc Ar idtype Ar idrange Oo not Oc Ar jailtype Ar jailidrange
.Pp
If some specification (id or jail) is omited it means "any".
The
.Li not
keyword negates the match.
Underscore can be used in place of space.
.Bl -tag -width ".Ar action"
.It Ar action
Describes the result of the rule, either
.Li allow
or
.Li deny .
.It Ar idtype
Describes the type of subject match to be performed.
Either
.Li uid
for user ID matching, or
.Li gid
for group ID matching.
.It Ar idrange : Bro Ar id | id Ns \&- Ns Ar id Ns Brc Ns Op , Ns Ar idrange
The user or group IDs range (depending on
.Ar idtype )
allowed to set system time.
.Bf -emphasis
NOTE: User and group names are not valid; only the actual ID numbers
may be used.
.Ef
.It Ar jailtype
Describes which jail match to be performed.
Either
.Li nojail
for the main system, or
.Li jail
for some jail, id range must be specified.
.It Ar jailidrange : Bro Ar jailid | jailid Ns \&- Ns Ar jailid Ns Brc Ns Op , Ns Ar jailidrange
IDs of jail allowed to set system time.
.Pp
.El
.Bf -emphasis
NOTE: MAC security policies may not override other security system policies
by allowing accesses that they may deny, such as
.Va kern.useradjtime /
.Va kern.jailadjtime /
.Va kern.usersettime /
.Va kern.jailsettime .
.Ef
If the internal kernel security checks are not disabled, the
.Nm
entry will not function
(i.e., even the specified user/group/jail may not be able to set system time).
.Sh EXAMPLES
To allow some user to set system time set
.Va security.mac.settime.rules
.Xr sysctl 8
MIBs to:
.Pp
.Dl "allow uid 2000 nojail"
.Pp
To additionaly allow root to set time from several jails set the
.Va security.mac.settime.rules
to:
.Pp
.Dl "allow uid 2000 nojail"
.Dl "allow uid 0 jail 4,5-9"
.Pp
If the MIB is set from /etc/sysctl.conf no spaces and new lines are allowed by /etc/rc.d/sysctl, so
the last example can be written in another form:
.Pp
.Dl "allow_uid_2000_nojail;allow_uid_0_jail_4,5-9"
.Pp
.Sh SEE ALSO
.Xr mac 3 ,
.Xr ip 4 ,
.Xr mac_biba 4 ,
.Xr mac_bsdextended 4 ,
.Xr mac_ifoff 4 ,
.Xr mac_mls 4 ,
.Xr mac_none 4 ,
.Xr mac_partition 4 ,
.Xr mac_seeotheruids 4 ,
.Xr mac_portacl 4 ,
.Xr mac_test 4 ,
.Xr mac 9
.Sh HISTORY
MAC first appeared in
.Fx 5.0