Date: Tue, 11 Aug 2009 17:51:50 GMT From: Steve Polyack <spolyack@collaborativefusion.com> To: freebsd-gnats-submit@FreeBSD.org Subject: misc/137677: security.mac.bsdextended.firstmatch_enabled default is incorrect Message-ID: <200908111751.n7BHpoHI082935@www.freebsd.org> Resent-Message-ID: <200908111800.n7BI0GCw007177@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 137677
>Category: misc
>Synopsis: security.mac.bsdextended.firstmatch_enabled default is incorrect
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Tue Aug 11 18:00:16 UTC 2009
>Closed-Date:
>Last-Modified:
>Originator: Steve Polyack
>Release: 7.2-RELEASE
>Organization:
Collaborative Fusion, Inc.
>Environment:
FreeBSD xxxxx 7.2-RELEASE-p3 FreeBSD 7.2-RELEASE-p3 #0: Tue Aug 11 10:34:08 EDT 2009 root@xxxxx:/usr/obj/usr/src/sys/GENERIC-MAC amd64
>Description:
The manpage for the mac_bsdextended kernel module states that the default for the security.mac.bsdextended.firstmatch_enabled is 1. This does not appear to be true, as a recently rebuilt 6.3 machine as well as a fresh 7.2-RELEASE install both have the sysctl set to 0 upon loading the module:
$ sysctl security.mac.bsdextended.firstmatch_enabled
security.mac.bsdextended.firstmatch_enabled: 0
The source code for the module appears to initialize the sysctl with the (correct) value of 1, so I'm unsure as to where the problem actually is:
/*
* This tunable is here for compatibility. It will allow the user to switch
* between the new mode (first rule matches) and the old functionality (all
* rules match).
*/
static int ugidfw_firstmatch_enabled;
SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, firstmatch_enabled,
CTLFLAG_RW, &ugidfw_firstmatch_enabled, 1,
"Disable/enable match first rule functionality");
>How-To-Repeat:
- Build and install a kernel with 'options MAC'.
- Reboot and kldload mac_bsdextended.
- Observe that the sysctl security.mac.bsdextended.firstmatch_enabled is set to 0 after spending a good amount of time wondering why your ugidfw rules aren't working as expected.
>Fix:
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200908111751.n7BHpoHI082935>