diff options
author | garys <garys@FreeBSD.org> | 2005-09-03 17:16:00 +0000 |
---|---|---|
committer | garys <garys@FreeBSD.org> | 2005-09-03 17:16:00 +0000 |
commit | dcf881b1eb5cd7d4101ff068dead8b12f344a057 (patch) | |
tree | f098353d547c2febae40d4cf27a37d14eea6d6e6 /share/man/man7/security.7 | |
parent | 50da0d71bf56d64b1d31b1a4aac5828acc47dc99 (diff) | |
download | FreeBSD-src-dcf881b1eb5cd7d4101ff068dead8b12f344a057.zip FreeBSD-src-dcf881b1eb5cd7d4101ff068dead8b12f344a057.tar.gz |
Moved descriptions of securelevels from init(7) to security(7).
Files used both "securelevel" and either "secure level" or
"security level"; all are now "security level".
PR: docs/84266
Submitted by: garys
Approved by: keramida
MFC after: 3 days
Diffstat (limited to 'share/man/man7/security.7')
-rw-r--r-- | share/man/man7/security.7 | 70 |
1 files changed, 63 insertions, 7 deletions
diff --git a/share/man/man7/security.7 b/share/man/man7/security.7 index ee6031c..2a74657 100644 --- a/share/man/man7/security.7 +++ b/share/man/man7/security.7 @@ -498,14 +498,14 @@ his own .Xr bpf 4 device or other sniffing device on a running kernel. To avoid these problems you have to run -the kernel at a higher secure level, at least securelevel 1. -The securelevel can be set with a +the kernel at a higher security level, at least level 1. +The security level can be set with a .Xr sysctl 8 on the .Va kern.securelevel variable. Once you have -set the securelevel to 1, write access to raw devices will be denied and +set the security level to 1, write access to raw devices will be denied and special .Xr chflags 1 flags, such as @@ -515,12 +515,12 @@ You must also ensure that the .Cm schg flag is set on critical startup binaries, directories, and -script files \(em everything that gets run up to the point where the securelevel -is set. +script files \(em everything that gets run +up to the point where the security level is set. This might be overdoing it, and upgrading the system is much more -difficult when you operate at a higher secure level. +difficult when you operate at a higher security level. You may compromise and -run the system at a higher secure level but not set the +run the system at a higher security level but not set the .Cm schg flag for every system file and directory under the sun. @@ -533,6 +533,62 @@ read-only. It should be noted that being too draconian in what you attempt to protect may prevent the all-important detection of an intrusion. +.Pp +The kernel runs with five different security levels. +Any super-user process can raise the level, but no process +can lower it. +The security levels are: +.Bl -tag -width flag +.It Ic -1 +Permanently insecure mode \- always run the system in insecure mode. +This is the default initial value. +.It Ic 0 +Insecure mode \- immutable and append-only flags may be turned off. +All devices may be read or written subject to their permissions. +.It Ic 1 +Secure mode \- the system immutable and system append-only flags may not +be turned off; +disks for mounted file systems, +.Pa /dev/mem , +.Pa /dev/kmem +and +.Pa /dev/io +(if your platform has it) may not be opened for writing; +kernel modules (see +.Xr kld 4 ) +may not be loaded or unloaded. +.It Ic 2 +Highly secure mode \- same as secure mode, plus disks may not be +opened for writing (except by +.Xr mount 2 ) +whether mounted or not. +This level precludes tampering with file systems by unmounting them, +but also inhibits running +.Xr newfs 8 +while the system is multi-user. +.Pp +In addition, kernel time changes are restricted to less than or equal to one +second. +Attempts to change the time by more than this will log the message +.Dq Time adjustment clamped to +1 second . +.It Ic 3 +Network secure mode \- same as highly secure mode, plus +IP packet filter rules (see +.Xr ipfw 8 , +.Xr ipfirewall 4 +and +.Xr pfctl 8 ) +cannot be changed and +.Xr dummynet 4 +or +.Xr pf 4 +configuration cannot be adjusted. +.El +.Pp +The security level is discussed further in +.Xr init 8 +and can be configured with variables documented in +.Xr rc.conf 8 . .Sh CHECKING FILE INTEGRITY: BINARIES, CONFIG FILES, ETC When it comes right down to it, you can only protect your core system configuration and control files so much before the convenience factor |