From 80d37f5b20040e5a41f839aad50519c5e0133ea6 Mon Sep 17 00:00:00 2001
From: rwatson <rwatson@FreeBSD.org>
Date: Tue, 3 Dec 2002 15:16:10 +0000
Subject: Hook up a sample LOMAC labeling policy.  Unlike the old LOMAC module,
 the file system initial labeling policy exists in userland, and is fed into
 setfsmac(1).  This is based on the old LOMAC PLM.

Approved by:	re
Obtained from:	TrustedBSD Project
Sponsored by:	DARPA, Network Associates Laboratories
---
 share/security/lomac-policy.contexts | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)
 create mode 100644 share/security/lomac-policy.contexts

(limited to 'share/security')

diff --git a/share/security/lomac-policy.contexts b/share/security/lomac-policy.contexts
new file mode 100644
index 0000000..e01bd28
--- /dev/null
+++ b/share/security/lomac-policy.contexts
@@ -0,0 +1,29 @@
+# $FreeBSD$
+#
+# This is a sample LOMAC policy based upon the PLM defined in the
+# original FreeBSD LOMAC port.  It may be configured on a
+# system via setfsmac(8).
+
+.*				lomac/high
+/sbin/dhclient			lomac/high[low]
+/dev(/.*)?			lomac/equal
+# This is not an exhaustive list of all "privileged" devices.
+/dev/mdctl			lomac/high
+/dev/pci			lomac/high
+/dev/k?mem			lomac/high
+/dev/io				lomac/high
+/dev/agp.*			lomac/high
+(/var)?/tmp(/.*)?		lomac/equal
+/tmp/\.X11-unix			lomac/high[equal]
+/tmp/\.X11-unix/.*		lomac/equal
+/proc(/.*)?			lomac/equal
+/mnt.*				lomac/low
+(/usr)?/home			lomac/high[low]
+(/usr)?/home/.*			lomac/low
+/var/mail(/.*)?			lomac/low
+/var/spool/mqueue(/.*)?		lomac/low
+(/mnt)?/cdrom(/.*)?		lomac/high
+(/usr)?/home/(ftp|samba)(/.*)?	lomac/high
+/var/log/sendmail\.st		lomac/low
+/var/run/utmp			lomac/equal
+/var/log/(lastlog|wtmp)		lomac/equal
-- 
cgit v1.1