From owner-freebsd-doc@FreeBSD.ORG  Tue May  9 22:03:48 2006
Return-Path: <owner-freebsd-doc@FreeBSD.ORG>
X-Original-To: doc@FreeBSD.org
Delivered-To: freebsd-doc@FreeBSD.ORG
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id C404816A40B;
	Tue,  9 May 2006 22:03:48 +0000 (UTC)
	(envelope-from trhodes@FreeBSD.org)
Received: from pittgoth.com (ns1.pittgoth.com [216.38.206.188])
	by mx1.FreeBSD.org (Postfix) with ESMTP id DBECA43D55;
	Tue,  9 May 2006 22:03:44 +0000 (GMT)
	(envelope-from trhodes@FreeBSD.org)
Received: from localhost (ip70-177-190-239.dc.dc.cox.net [70.177.190.239])
	(authenticated bits=0)
	by pittgoth.com (8.13.4/8.13.4) with ESMTP id k49N6IlK068227
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT);
	Tue, 9 May 2006 19:06:19 -0400 (EDT)
	(envelope-from trhodes@FreeBSD.org)
Date: Tue, 9 May 2006 18:03:42 -0400
From: Tom Rhodes <trhodes@FreeBSD.org>
To: Borja Marcos <borjamar@sarenet.es>
Message-Id: <20060509180342.5136da89.trhodes@FreeBSD.org>
In-Reply-To: <EF8D2BEE-7509-48D0-9CAC-4B92BE01AF71@sarenet.es>
References: <EF8D2BEE-7509-48D0-9CAC-4B92BE01AF71@sarenet.es>
X-Mailer: Sylpheed version 1.0.5 (GTK+ 1.2.10; i386-portbld-freebsd7.0)
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Cc: freebsd-security@FreeBSD.org, doc@FreeBSD.org
Subject: Re: Errors in the FreeBSD handbook (MAC framework)
X-BeenThere: freebsd-doc@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Documentation project <freebsd-doc.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-doc>,
	<mailto:freebsd-doc-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-doc>
List-Post: <mailto:freebsd-doc@freebsd.org>
List-Help: <mailto:freebsd-doc-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-doc>,
	<mailto:freebsd-doc-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 09 May 2006 22:03:51 -0000

On Tue, 9 May 2006 18:22:05 +0200
Borja Marcos <borjamar@sarenet.es> wrote:

> (crossposted to freebsd-security just in case someone has to slap me) :)
> 
> 
> Hello,
> 
> I'm doing some work with the MAC subsystem in FreeBSD, and I have  
> spotted some errors in the MAC documentation in the handbook.
> 
> 1- Section 15.14.4. Error in the example dropping users "nagios" and  
> "www" into the insecure class. The example uses the command "pw  
> usermod nagios -L default" when it should obviously be "pw usermod  
> nagios -L insecure". The same holds for the "www" user.
> 
> 2- Section 15.14.6.
> 
> The example script launches the commands "apachectl", and "/usr/local/ 
> etc/rc.d/nagios.sh" with the label biba/10, but they should be  
> launched with the label biba/10(10-10).
> 
> I've defined the "default" login class with a label of "biba/high". I  
> login at the machine as root, and...
> 
> -----
> # getpmac
> biba/high(low-high)
> # setpmac biba/low getpmac
> biba/low(low-high)
> # setpmac biba/low setpmac biba/high getpmac
> biba/high(low-high)
> 
> 
> So, if I launch a process with a "setpmac biba/low", it actually  
> inherits a label of "biba/low(high-low)", being able to recover its  
> biba/high setting, something that wouldn't be desirable. However,  
> launching it with a label of "biba/low(low-low)" effectively  
> downgrades the process forever
> 
> # setpmac "biba/low(low-low)" getpmac
> biba/low(low-low)
> # setpmac "biba/low(low-low)" setpmac biba/high getpmac
> biba/high: Operation not permitted

Yea, I'm still in the process of doing updates to this chapter,
sorry for the current issues.  :(

-- 
Tom Rhodes