options MAC

mac_biba_load="YES"

default:\
....[color=red]\[/color]
:label=biba/high(low-high):

>cap_mkdb /etc/login.conf

>pw usershow root
root:*:0:0:default:0:0:Charlie &:/root:/bin/csh

>pw usermod root -L default

>ps -axZ
....
biba/high(low-high) 1 ?? ILs 0:00,00 /sbin/init -s
....

>getpmac
biba/high(low-high)

>getfmac /etc/login.conf
/etc/login.conf: biba/high

>setpmac biba/low csh
>getpmac
biba/low(low-high)

>touch test
>setfmac biba/low test
setfmac: labeling not supported in test

>tunefs -l enable /dev/ad8s1e

>touch test
>setfmac biba/low test
>getfmac test
test: biba/low

>setpmac biba/low csh

>getpmac
biba/low(low-high)
>setfmac biba/high ./test
>exit
exit
>rm test

>cat /boot/loader.conf
mac_lomac_load="YES"

:label=biba/high(low-high):

:label=lomac/high(low-high):

>cap_mkdb /etc/login.conf

>mkdir dir
>getfmac dir
dir: lomac/high
>touch dir/test1
>getfmac dir/test1
dir/test1: lomac/high
>setfmac 'lomac/low' dir
>getfmac dir
dir: lomac/low
>touch dir/test2
>getfmac dir/test1
dir/test2: lomac/high

>getpmac
lomac/high(low-high)
>mkdir dir
>setfmac 'lomac/high[low]' dir
>touch dir/test
>getfmac dir/test
dir/test: lomac/low[low]
>getfmac dir
dir: lomac/high[low]

>cp /usr/bin/top ./
>setfmac 'lomac/high[low]' top
>./top &
[1] 4716
>setpmac lomac/low csh
>getpmac -p 4716
lomac/low(low-high)

>ifconfig
re0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
...
 maclabel lomac/low(low-low)
...

>ifconfig re0 maclabel lomac/equal

>cat /etc/sysctl.conf
security.mac.lomac.trust_all_interfaces=1

>cat /boot/loader.conf
mac_lomac_load="YES"

>grep bce /etc/rc.conf
ifconfig_bce0="inet 10.100.100.100/24 maclabel lomac/equal(equal-equal)"

PidFile "/var/run/httpd/httpd.pid"

apache22_pidfile="/var/run/httpd/httpd.pid"

load_rc_config $name

eval pidfile="\${apache22_pidfile:-${pidfile}}"

>mkdir /var/run/httpd/

ErrorLog "/var/log/httpd/httpd-error.log"
CustomLog "/var/log/httpd/httpd-access.log" combined

>mkdir /var/log/httpd/

>/usr/local/etc/rc.d/apache22 start
>/usr/local/etc/rc.d/apache22 stop

>setfmac 'lomac/low[low]' /var/log/httpd/
>setfmac 'lomac/low[low]' /var/run/httpd/

>setfmac 'lomac/equal' /tmp/

php_admin_value session.save_path /var/tmp/session/vhost1

>setfmac 'lomac/low(low-low)' /var/tmp/session/vhost1

>setfmac 'lomac/equal' /var/spool/clientmqueue

>setfmac 'lomac/high[low]' /usr/local/sbin/httpd

>setpmac 'lomac/low(low-low)' csh
>getpmac
lomac/low(low-low)
>/usr/local/etc/rc.d/apache22 start
>ps -axZ | grep http | head -1
lomac/low(low-low) 36723 ?? SsJ 0:00,96 /usr/local/sbin/httpd -DNOHTTPACCEPT
>exit
exit
>getpmac
lomac/high(low-high)
>ps -axZ | grep http | head -1
>

>grep apache22 /etc/rc.conf 
#apache22_enable="YES"
apache22_lomac_enable="YES"
apache22_pidfile="/var/run/httpd/httpd.pid"

>cat rc.d/apache22_lomac 
#!/bin/sh

# PROVIDE: apache22_lomac
# REQUIRE: DAEMON
# BEFORE: LOGIN
# KEYWORD: shutdown

if [ -z `egrep ^apache22_lomac_enable=\"[Ye][Ee][Ss]\" \
 /etc/rc.conf` ]; then
 echo "apache22_lomac is not enabled in rc.conf"
 exit 1;
fi

command="/usr/sbin/setpmac lomac/low(low-low) /usr/local/etc/rc.d/apache22"

apache22_start() {
 echo Starting apache in lomac/low
 $command forcestart
}

apache22_command() {
 echo Performing $1 command in lomac/low
 $command $1
}

case $1 in
 start)
 apache22_start;;
 quietstart)
 apache22_start;;
 stop)
 apache22_command $1;;
 restart)
 apache22_command stop;
 apache22_start;;
 status)
 apache22_command $1;;
 reload)
 apache22_command $1;;
 configtest)
 apache22_command $1;;
 *)
 echo "Usage: rc.d/apache22_lomac \
 (start|stop|restart|status|reload|configtest)"
 ;;
esac

return 0;