blob: 4f0e838bbf5f0886c48b32931f7ce46a6b29d6e4 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
|
# Copyright (c) 2026 The FreeBSD Foundation
#
# SPDX-License-Identifier: BSD-2-Clause
#
# This software was developed by Olivier Certner <olce@FreeBSD.org> at
# Kumacom SARL under sponsorship from the FreeBSD Foundation.
rules_parameter()
{
echo "$1".rules
}
exec_paths_parameter()
{
echo "$1".exec_paths
}
: ${MDO:=/usr/bin/mdo}
ROOT_KNOB=security.mac.do
RULES_KNOB=$(rules_parameter ${ROOT_KNOB})
EXEC_PATHS_KNOB=$(exec_paths_parameter ${ROOT_KNOB})
PPE_KNOB=${ROOT_KNOB}.print_parse_error
ROOT_JAIL_PARAM=mac.do
RULES_JAIL_PARAM=$(rules_parameter ${ROOT_JAIL_PARAM})
EXEC_PATHS_JAIL_PARAM=$(exec_paths_parameter ${ROOT_JAIL_PARAM})
# To be overridden to execute commands in a sub-jail
JEXEC=
# Exit status: 0 iff disabled
mac_do_disabled()
{
[ -z "$($JEXEC sysctl -n ${RULES_KNOB})" ] ||
[ -z "$($JEXEC sysctl -n ${EXEC_PATHS_KNOB})" ]
}
mac_do_check_disabled()
{
mac_do_disabled || atf_fail "mac_do(4) expected disabled but is not."
}
mac_do_ensure_disabled()
{
mac_do_disabled || $JEXEC sysctl ${RULES_KNOB}=""
}
sysctl_rules()
{
$JEXEC sysctl -n ${RULES_KNOB}
}
sysctl_exec_paths()
{
$JEXEC sysctl -n ${EXEC_PATHS_KNOB}
}
# $1 = sysctl func, $2 = expected value
sysctl_check()
{
local func value
func=$1
value=$2
atf_check [ "$($func)" = "$value" ]
}
# $1 = value
sysctl_check_rules()
{
local value
value=$1
sysctl_check sysctl_rules $value
}
# $1 = value
sysctl_check_exec_paths()
{
local value
value=$1
sysctl_check sysctl_exec_paths $value
}
# $1 = knob name, $2 = value
sysctl_set_and_check()
{
local knob value
knob=$1
value=$2
atf_check -o ignore $JEXEC sysctl "$knob"="$value"
atf_check -o inline:"$value\n" $JEXEC sysctl -n "$knob"
}
# $1 = knob name, $2 = value
sysctl_set_and_check_fails()
{
local knob value orig_value
knob=$1
value=$2
orig_value=$(sysctl -n "$knob")
atf_check -s not-exit:0 -o ignore -e ignore $JEXEC sysctl "$knob"="$value"
atf_check -o inline:"${orig_value}\n" $JEXEC sysctl -n "$knob"
}
# $1 = sysctl function, $2 = value
sysctl_set_and_check_rules_common()
{
local func value
func=$1
value=$2
# Use older in-rule separator (':') first to have final value as specified
"$func" ${RULES_KNOB} "$(echo "$value" | sed 's%>%:%')"
"$func" ${RULES_KNOB} "$value"
}
# $1 = value
sysctl_set_and_check_rules()
{
local value
value=$1
sysctl_set_and_check_rules_common sysctl_set_and_check "$value"
}
# $1 = value
sysctl_set_and_check_fails_rules()
{
local value
value=$1
sysctl_set_and_check_rules_common sysctl_set_and_check_fails "$value"
}
# $1 = sysctl function, $2 = value
sysctl_set_and_check_exec_paths_common()
{
local func value
func=$1
value=$2
# Use older in-rule separator (':') first to have final value as specified
"$func" ${EXEC_PATHS_KNOB} "$(echo "$value" | sed 's%>%:%')"
"$func" ${EXEC_PATHS_KNOB} "$value"
}
# $1 = value
sysctl_set_and_check_exec_paths()
{
local value
value=$1
sysctl_set_and_check_exec_paths_common sysctl_set_and_check "$value"
}
# Create a persistent subjail. Echoes its JID.
launch_subjail()
{
(
set -o pipefail
$JEXEC jail -c -J /dev/stdout persist=true |
sed -nE 's%^.*jid=([0-9]+).*$%\1%p'
) || atf_fail "Cannot create a subjail (check children limits?)"
}
atf_require_prog sysctl
atf_require_prog jail
atf_require_prog sed
# Do not pollute kernel logs with parse errors
sysctl $PPE_KNOB=0 >/dev/null 2>&1
|
