named policy for systrace

src/etc/Makefile

@@ -1,4 +1,4 @@
-#	$OpenBSD: Makefile,v 1.167 2002/06/17 00:09:44 deraadt Exp $
+#	$OpenBSD: Makefile,v 1.168 2002/07/18 20:37:47 provos Exp $
 
 TZDIR=		/usr/share/zoneinfo
 LOCALTIME=	US/Pacific
@@ -170,6 +170,9 @@ distribution-etc-root-var: distrib-dirs
 		    ${DESTDIR}/etc/afs; \
 		${INSTALL} -c -o root -g wheel -m 644 README \
 		    ${DESTDIR}/etc/afs
+	cd systrace; \
+		${INSTALL} -c -o root -g wheel -m 600 usr_sbin_named \
+		    ${DESTDIR}/etc/systrace;
 	cd namedb; \
 	    ${INSTALL} -c -o root -g ${BINGRP} -m 644 named.boot \
 		${DESTDIR}/var/named; \

src/etc/systrace/usr_sbin_named

@@ -0,0 +1,77 @@
+# Policy for named that uses named user and chroots to /var/named
+# This policy works for the default configuration of named.
+Policy: /usr/sbin/named, Emulation: native
+	native-__sysctl: permit
+	native-accept: permit
+	native-bind: sockaddr match "inet-*:53" then permit
+	native-break: permit
+	native-chdir: filename eq "/" then permit
+	native-chdir: filename eq "/namedb" then permit
+	native-chroot: filename eq "/var/named" then permit
+	native-close: permit
+	native-connect: sockaddr eq "/dev/log" then permit
+	native-dup2: permit
+	native-exit: permit
+	native-fcntl: permit
+	native-fork: permit
+	native-fsread: filename eq "/" then permit
+	native-fsread: filename eq "/dev/arandom" then permit
+	native-fsread: filename eq "/etc/group" then permit
+	native-fsread: filename eq "/etc/localtime" then permit
+	native-fsread: filename eq "/etc/malloc.conf" then permit
+	native-fsread: filename eq "/etc/protocols" then permit
+	native-fsread: filename eq "/etc/resolv.conf" then permit
+	native-fsread: filename eq "/etc/services" then permit
+	native-fsread: filename eq "/etc/spwd.db" then permit
+	native-fsread: filename eq "/named.boot" then permit
+	native-fsread: filename eq "/usr/lib" then permit
+	native-fsread: filename eq "/usr/libexec/ld.so" then permit
+	native-fsread: filename eq "/var/run/ld.so.hints" then permit
+	native-fsread: filename eq "<non-existent filename>" then deny[enoent]
+	native-fsread: filename match "/namedb/*" then permit
+	native-fsread: filename match "/usr/lib/*" then permit
+	native-fsread: filename match "/usr/share/nls/*" then permit
+	native-fsread: filename match "/usr/share/zoneinfo/*" then permit
+	native-fstat: permit
+	native-fswrite: filename eq "/dev/console" then permit
+	native-fswrite: filename eq "/dev/null" then permit
+	native-fswrite: filename eq "/named.pid" then permit
+	native-geteuid: permit
+	native-getgid: permit
+	native-getpeername: permit
+	native-getpid: permit
+	native-getpriority: permit
+	native-getrlimit: permit
+	native-getsockopt: permit
+	native-gettimeofday: permit
+	native-getuid: permit
+	native-issetugid: permit
+	native-listen: permit
+	native-lseek: permit
+	native-mmap: permit
+	native-mprotect: permit
+	native-munmap: permit
+	native-nanosleep: permit
+	native-pipe: permit
+	native-pread: permit
+	native-read: permit
+	native-recvfrom: permit
+	native-select: permit
+	native-sendto: true then permit
+	native-setgid: gid eq "70" then permit
+	native-setgroups: permit
+	native-setitimer: permit
+	native-setpriority: permit
+	native-setrlimit: permit
+	native-setsid: permit
+	native-setsockopt: permit
+	native-setuid: uname eq "named" then permit
+	native-sigaction: permit
+	native-sigprocmask: permit
+	native-sigreturn: permit
+	native-socket: permit
+	native-umask: permit
+	native-wait4: permit
+	native-write: permit
+	native-writev: permit
+