From fbc57aea01d0642bae22ae489fc90f224c5dd77f Mon Sep 17 00:00:00 2001 From: sturm <> Date: Thu, 13 May 2004 04:50:04 +0000 Subject: [PATCH] - update policies to what is actually needed in -current - deny access to /etc/spwd.db, permit pwd.db instead - fixes pr 3748 - cosmetics "toss it in" deraadt@ --- src/etc/systrace/usr_sbin_lpd | 16 +++++++++------- src/etc/systrace/usr_sbin_named | 27 ++++++++++++++++----------- 2 files changed, 25 insertions(+), 18 deletions(-) diff --git a/src/etc/systrace/usr_sbin_lpd b/src/etc/systrace/usr_sbin_lpd index d54c2067..95303029 100644 --- a/src/etc/systrace/usr_sbin_lpd +++ b/src/etc/systrace/usr_sbin_lpd @@ -1,4 +1,4 @@ -# $OpenBSD: usr_sbin_lpd,v 1.4 2003/03/28 21:32:30 jmc Exp $ +# $OpenBSD: usr_sbin_lpd,v 1.5 2004/05/13 04:50:04 sturm Exp $ # # Policy for lpd. # This policy works for the default configuration of lpd. @@ -27,17 +27,18 @@ Policy: /usr/sbin/lpd, Emulation: native native-fsread: filename eq "/etc/malloc.conf" then permit native-fsread: filename eq "/etc/printcap" then permit native-fsread: filename eq "/etc/printcap.db" then permit + native-fsread: filename eq "/etc/pwd.db" then permit native-fsread: filename eq "/etc/resolv.conf" then permit native-fsread: filename eq "/etc/services" then permit - native-fsread: filename eq "/etc/spwd.db" then permit + native-fsread: filename eq "/etc/spwd.db" then deny[eperm] native-fsread: filename eq "/usr/libexec/ld.so" then permit native-fsread: filename eq "/var/run/ld.so.hints" then permit native-fsread: filename eq "" then deny[enoent] - native-fsread: filename match "/usr/lib/*" then permit - native-fsread: filename match "/usr/share/nls/*" then permit - native-fsread: filename match "/usr/share/zoneinfo/*" then permit - native-fsread: filename match "/var/spool/lpd/*" then permit - native-fsread: filename match "/var/spool/output/*" then permit + native-fsread: filename match "/usr/lib" then permit + native-fsread: filename match "/usr/share/nls" then permit + native-fsread: filename match "/usr/share/zoneinfo" then permit + native-fsread: filename match "/var/spool/lpd" then permit + native-fsread: filename match "/var/spool/output" then permit native-fstat: permit native-fstatfs: permit native-fswrite: filename eq "/dev/console" then permit @@ -61,6 +62,7 @@ Policy: /usr/sbin/lpd, Emulation: native native-lseek: permit native-mmap: permit native-mprotect: permit + native-mquery: permit native-munmap: permit native-nanosleep: permit native-pread: permit diff --git a/src/etc/systrace/usr_sbin_named b/src/etc/systrace/usr_sbin_named index f3887c2f..0e2f11a5 100644 --- a/src/etc/systrace/usr_sbin_named +++ b/src/etc/systrace/usr_sbin_named @@ -1,4 +1,4 @@ -# $OpenBSD: usr_sbin_named,v 1.4 2003/02/09 22:40:24 djm Exp $ +# $OpenBSD: usr_sbin_named,v 1.5 2004/05/13 04:50:04 sturm Exp $ # # Policy for named that uses named user and chroots to /var/named # This policy works for the default configuration of named. @@ -13,6 +13,7 @@ Policy: /usr/sbin/named, Emulation: native native-chdir: filename eq "/" then permit native-chroot: filename eq "/var/named" then permit native-close: permit + native-closefrom: permit native-connect: sockaddr eq "/dev/log" then permit native-connect: sockaddr match "inet-*" then permit native-dup2: permit @@ -25,18 +26,16 @@ Policy: /usr/sbin/named, Emulation: native native-fsread: filename eq "/etc/group" then permit native-fsread: filename eq "/etc/named.conf" then permit native-fsread: filename eq "/etc/named.keys" then permit + native-fsread: filename eq "/etc/pwd.db" then permit native-fsread: filename eq "/etc/rndc.key" then permit - native-fsread: filename eq "/etc/spwd.db" then permit - native-fsread: filename eq "/master" then permit - native-fsread: filename match "/master/*" then permit - native-fsread: filename eq "/slave" then permit - native-fsread: filename match "/slave/*" then permit - native-fsread: filename eq "/standard" then permit - native-fsread: filename match "/standard/*" then permit - native-fsread: filename match "/usr/lib/*" then permit + native-fsread: filename eq "/etc/spwd.db" then deny[eperm] + native-fsread: filename match "/master" then permit + native-fsread: filename match "/slave" then permit + native-fsread: filename match "/standard" then permit + native-fsread: filename match "/usr/lib" then permit native-fsread: filename eq "/usr/libexec/ld.so" then permit - native-fsread: filename match "/usr/share/nls/*" then permit - native-fsread: filename match "/usr/share/zoneinfo/*" then permit + native-fsread: filename match "/usr/share/nls" then permit + native-fsread: filename match "/usr/share/zoneinfo" then permit native-fsread: filename eq "/var/run/ld.so.hints" then permit native-fsread: filename eq "/var/run/named.pid" then permit native-fstat: permit @@ -48,6 +47,7 @@ Policy: /usr/sbin/named, Emulation: native native-fswrite: filename match "/var/tmp/*" then permit native-fsync: permit native-getpid: permit + native-getppid: permit native-getrlimit: permit native-getsockname: permit native-getsockopt: permit @@ -60,6 +60,7 @@ Policy: /usr/sbin/named, Emulation: native native-lseek: permit native-mmap: permit native-mprotect: permit + native-mquery: permit native-munmap: permit native-nanosleep: permit native-pread: permit @@ -69,6 +70,8 @@ Policy: /usr/sbin/named, Emulation: native native-select: permit native-sendmsg: permit native-sendto: true then permit + native-setegid: gid eq "70" then permit + native-seteuid: uid eq "70" and uname eq "named" then permit native-setgid: gid eq "70" then permit native-setgroups: permit native-setrlimit: permit @@ -79,5 +82,7 @@ Policy: /usr/sbin/named, Emulation: native native-sigprocmask: permit native-sigreturn: permit native-socket: permit + native-socketpair: permit native-utimes: permit + native-wait4: permit native-write: permit