aboutsummaryrefslogtreecommitdiff
path: root/contrib/bsddialog/bsdconfig/security/include/securelevel.hlp
diff options
context:
space:
mode:
Diffstat (limited to 'contrib/bsddialog/bsdconfig/security/include/securelevel.hlp')
-rw-r--r--contrib/bsddialog/bsdconfig/security/include/securelevel.hlp40
1 files changed, 0 insertions, 40 deletions
diff --git a/contrib/bsddialog/bsdconfig/security/include/securelevel.hlp b/contrib/bsddialog/bsdconfig/security/include/securelevel.hlp
deleted file mode 100644
index 27eb1ec231b9..000000000000
--- a/contrib/bsddialog/bsdconfig/security/include/securelevel.hlp
+++ /dev/null
@@ -1,40 +0,0 @@
-This menu allows you to configure the Securelevel mechanism in FreeBSD.
-
-Securelevels may be used to limit the privileges assigned to the
-root user in multi-user mode, which in turn may limit the effects of
-a root compromise, at the cost of reducing administrative functions.
-Refer to the security(7) and init(8) manual pages for complete details.
-
- -1 Permanently insecure mode - always run the system in level 0
- mode. This is the default initial value.
-
- 0 Insecure mode - immutable and append-only flags may be turned
- off. All devices may be read or written subject to their
- permissions.
-
- 1 Secure mode - the system immutable and system append-only
- flags may not be turned off; disks for mounted file systems,
- /dev/mem, /dev/kmem and /dev/io (if your platform has it)
- may not be opened for writing; kernel modules (see kld(4))
- may not be loaded or unloaded.
-
- 2 Highly secure mode - same as secure mode, plus disks may not
- be opened for writing (except by mount(2)) whether mounted or
- not. This level precludes tampering with file systems by
- unmounting them, but also inhibits running newfs(8) while the
- system is multi-user.
-
- In addition, kernel time changes are restricted to less than
- or equal to one second. Attempts to change the time by more
- than this will log the message ``Time adjustment clamped to +1
- second''.
-
- 3 Network secure mode - same as highly secure mode, plus IP
- packet filter rules (see ipfw(8), ipfirewall(4) and pfctl(8))
- cannot be changed and dummynet(4) or pf(4) configuration
- cannot be adjusted.
-
-Securelevels must be used in combination with careful system design and
-application of protective mechanisms to prevent system configuration
-files from being modified in a way that compromises the protections of
-the securelevel variable upon reboot.