policy for lpd

src/etc/Makefile

@@ -1,4 +1,4 @@
-#	$OpenBSD: Makefile,v 1.168 2002/07/18 20:37:47 provos Exp $
+#	$OpenBSD: Makefile,v 1.169 2002/07/18 20:57:50 provos Exp $
 
 TZDIR=		/usr/share/zoneinfo
 LOCALTIME=	US/Pacific
@@ -171,6 +171,8 @@ distribution-etc-root-var: distrib-dirs
 		${INSTALL} -c -o root -g wheel -m 644 README \
 		    ${DESTDIR}/etc/afs
 	cd systrace; \
+		${INSTALL} -c -o root -g wheel -m 600 usr_sbin_lpd \
+		    ${DESTDIR}/etc/systrace; \
 		${INSTALL} -c -o root -g wheel -m 600 usr_sbin_named \
 		    ${DESTDIR}/etc/systrace;
 	cd namedb; \

src/etc/systrace/usr_sbin_lpd

@@ -0,0 +1,72 @@
+# Policy for lpd.
+# This policy works for the default configuration of lpd.
+Policy: /usr/sbin/lpd, Emulation: native
+	native-__sysctl: permit
+	native-accept: permit
+	native-bind: sockaddr eq "/var/run/printer" then permit
+	native-bind: sockaddr match "inet-*:515" then permit
+	native-break: permit
+	native-chdir: permit
+	native-chmod: filename eq "/var/run/printer" then permit
+	native-chown: filename eq "/var/run/printer" then permit
+	native-close: permit
+	native-connect: sockaddr eq "/dev/log" then permit
+	native-connect: sockaddr match "inet-*:53" then permit
+	native-dup2: permit
+	native-exit: permit
+	native-fchmod: permit
+	native-fcntl: permit
+	native-fork: permit
+	native-fsread: filename eq "/dev/arandom" then permit
+	native-fsread: filename eq "/etc/malloc.conf" then permit
+	native-fsread: filename eq "/etc/printcap" then permit
+	native-fsread: filename eq "/etc/printcap.db" then permit
+	native-fsread: filename eq "/etc/resolv.conf" then permit
+	native-fsread: filename eq "/etc/services" then permit
+	native-fsread: filename eq "/etc/spwd.db" then permit
+	native-fsread: filename eq "/usr/libexec/ld.so" then permit
+	native-fsread: filename eq "/var/run/ld.so.hints" then permit
+	native-fsread: filename eq "<non-existent filename>" then deny[enoent]
+	native-fsread: filename match "/usr/lib/*" then permit
+	native-fsread: filename match "/usr/share/nls/*" then permit
+	native-fsread: filename match "/usr/share/zoneinfo/*" then permit
+	native-fsread: filename match "/var/spool/lpd/*" then permit
+	native-fstat: permit
+	native-fstatfs: permit
+	native-fswrite: filename eq "/dev/console" then permit
+	native-fswrite: filename eq "/dev/null" then permit
+	native-fswrite: filename eq "/var/log/lpd-errs" then permit
+	native-fswrite: filename eq "/var/run/lpd.pid" then permit
+	native-fswrite: filename eq "/var/run/printer" then permit
+	native-fswrite: filename match "/var/spool/lpd/*" then permit
+	native-ftruncate: permit
+	native-getdirentries: permit
+	native-getegid: permit
+	native-geteuid: permit
+	native-getpid: permit
+	native-gettimeofday: permit
+	native-issetugid: permit
+	native-kill: permit
+	native-listen: permit
+	native-lseek: permit
+	native-mmap: permit
+	native-mprotect: permit
+	native-munmap: permit
+	native-pread: permit
+	native-read: permit
+	native-recvfrom: permit
+	native-select: permit
+	native-sendto: permit
+	native-setegid: gid eq "1" then permit
+	native-setegid: permit
+	native-seteuid: uid eq "0" then permit
+	native-seteuid: uid eq "1" then permit
+	native-setpgid: permit
+	native-setsid: permit
+	native-sigaction: permit
+	native-sigprocmask: permit
+	native-sigreturn: permit
+	native-socket: permit
+	native-umask: permit
+	native-wait4: permit
+	native-write: permit