This is an old revision of the document!
# fetch -qo - http://172.16.1.6/index.html # fetch -qo - http://172.16.1.6/../../etc/passwd
# rcsdiff /usr/src/sys/security/mac_mls/mac_mls.c
875c875 < mls_set_effective(dest, MAC_MLS_TYPE_LOW, 0, NULL); --- > mls_set_effective(dest, MAC_MLS_TYPE_EQUAL, 0, NULL);
# rcsdiff /usr/src/sys/security/mac_biba/mac_biba.c
915c915 < biba_set_effective(dest, MAC_BIBA_TYPE_HIGH, 0, NULL); --- > biba_set_effective(dest, MAC_BIBA_TYPE_EQUAL, 0, NULL);
# cat /boot/loader.conf
mac_mls_load="YES" mac_biba_load="YES"
# cat /etc/fstab
... /dev/ad0s1a / ufs ro 1 ...
Reboot in single mode
# tunefs -l enable / # mount -a # cat /etc/fstab
... /dev/ad0s1a / ufs rw 1 ...
Reboot in multiuser mode
# ps axZ # getfmac /etc/passwd
# cat /etc/policy.contexts
.* biba/high,mls/high / biba/equal,mls/equal /var biba/equal,mls/equal /var/www biba/equal,mls/equal /var/www/.* biba/equal,mls/equal /bin biba/equal,mls/equal /bin/sh biba/equal,mls/equal /libexec biba/equal,mls/equal /libexec/ld-elf.so.1 biba/equal,mls/equal /lib biba/equal,mls/equal /lib/libedit.so.7 biba/equal,mls/equal /lib/libncurses.so.8 biba/equal,mls/equal /lib/libc.so.7 biba/equal,mls/equal /usr biba/equal,mls/equal /usr/bin biba/equal,mls/equal /usr/bin/file biba/equal,mls/equal /lib/libz.so.5 biba/equal,mls/equal /usr/lib biba/equal,mls/equal /usr/lib/libmagic.so.4 biba/equal,mls/equal /usr/share biba/equal,mls/equal /usr/share/misc biba/equal,mls/equal /usr/share/misc/magic biba/equal,mls/equal /usr/local biba/equal,mls/equal /usr/local/sbin biba/equal,mls/equal /usr/local/sbin/webd biba/equal,mls/equal
# setfsmac -evf /etc/policy.contexts /
# cat /etc/inetd.conf
... http stream tcp nowait root /usr/sbin/setpmac setpmac biba/low,mls/low /usr/local/sbin/webd
# fetch -qo - http://172.16.1.6/index.html # fetch -qo - http://172.16.1.6/../../etc/passwd