mirror of
https://github.com/freebsd/freebsd-src
synced 2024-09-06 17:18:32 +00:00
![]() Functions implemented : - mac_veriexec_vnode_check_unlink: Unlink on a file has been requested and requires validation. This function prohibits the deleting a protected file (or deleting one of these hard links, if any). - mac_veriexec_vnode_check_rename_from: Rename the file has been requested and must be validated. This function controls the renaming of protected file - mac_veriexec_vnode_check_rename_to: File overwrite rename has been requested and must be validated. This function prevent overwriting of a file protected (overwriting by mv command). The 3 fonctions together aim to control the 'removal' (via unlink) and the 'mv' on files protected by veriexec. The intention is to reach the functional level of NetBSD veriexec. Add sysctl node security.mac.veriexec.unlink to toggle control on syscall unlink. Add tunable kernel variable security.mac.veriexec.block_unlink to toggle unlink protection. Add the corresponding read-only sysctl. [ tidied up commit message, trailing whitespace, long lines, { placement ] Reviewed by: sjg, imp Pull Request: https://github.com/freebsd/freebsd-src/pull/613 |
||
---|---|---|
.. | ||
audit | ||
mac | ||
mac_biba | ||
mac_bsdextended | ||
mac_ddb | ||
mac_ifoff | ||
mac_lomac | ||
mac_mls | ||
mac_none | ||
mac_ntpd | ||
mac_partition | ||
mac_pimd | ||
mac_portacl | ||
mac_priority | ||
mac_seeotheruids | ||
mac_stub | ||
mac_test | ||
mac_veriexec | ||
mac_veriexec_parser |