diff options
| -rw-r--r-- | etc/Makefile | 4 | ||||
| -rw-r--r-- | etc/systrace/usr_sbin_lpd | 72 |
2 files changed, 75 insertions, 1 deletions
diff --git a/etc/Makefile b/etc/Makefile index 8514eef8f3a..200131efa10 100644 --- a/etc/Makefile +++ b/etc/Makefile @@ -1,4 +1,4 @@ -# $OpenBSD: Makefile,v 1.168 2002/07/18 20:37:47 provos Exp $ +# $OpenBSD: Makefile,v 1.169 2002/07/18 20:57:50 provos Exp $ TZDIR= /usr/share/zoneinfo LOCALTIME= US/Pacific @@ -171,6 +171,8 @@ distribution-etc-root-var: distrib-dirs ${INSTALL} -c -o root -g wheel -m 644 README \ ${DESTDIR}/etc/afs cd systrace; \ + ${INSTALL} -c -o root -g wheel -m 600 usr_sbin_lpd \ + ${DESTDIR}/etc/systrace; \ ${INSTALL} -c -o root -g wheel -m 600 usr_sbin_named \ ${DESTDIR}/etc/systrace; cd namedb; \ diff --git a/etc/systrace/usr_sbin_lpd b/etc/systrace/usr_sbin_lpd new file mode 100644 index 00000000000..acd6525d485 --- /dev/null +++ b/etc/systrace/usr_sbin_lpd @@ -0,0 +1,72 @@ +# Policy for lpd. +# This policy works for the default configuration of lpd. +Policy: /usr/sbin/lpd, Emulation: native + native-__sysctl: permit + native-accept: permit + native-bind: sockaddr eq "/var/run/printer" then permit + native-bind: sockaddr match "inet-*:515" then permit + native-break: permit + native-chdir: permit + native-chmod: filename eq "/var/run/printer" then permit + native-chown: filename eq "/var/run/printer" then permit + native-close: permit + native-connect: sockaddr eq "/dev/log" then permit + native-connect: sockaddr match "inet-*:53" then permit + native-dup2: permit + native-exit: permit + native-fchmod: permit + native-fcntl: permit + native-fork: permit + native-fsread: filename eq "/dev/arandom" then permit + native-fsread: filename eq "/etc/malloc.conf" then permit + native-fsread: filename eq "/etc/printcap" then permit + native-fsread: filename eq "/etc/printcap.db" then permit + native-fsread: filename eq "/etc/resolv.conf" then permit + native-fsread: filename eq "/etc/services" then permit + native-fsread: filename eq "/etc/spwd.db" then permit + native-fsread: filename eq "/usr/libexec/ld.so" then permit + native-fsread: filename eq "/var/run/ld.so.hints" then permit + native-fsread: filename eq "<non-existent filename>" then deny[enoent] + native-fsread: filename match "/usr/lib/*" then permit + native-fsread: filename match "/usr/share/nls/*" then permit + native-fsread: filename match "/usr/share/zoneinfo/*" then permit + native-fsread: filename match "/var/spool/lpd/*" then permit + native-fstat: permit + native-fstatfs: permit + native-fswrite: filename eq "/dev/console" then permit + native-fswrite: filename eq "/dev/null" then permit + native-fswrite: filename eq "/var/log/lpd-errs" then permit + native-fswrite: filename eq "/var/run/lpd.pid" then permit + native-fswrite: filename eq "/var/run/printer" then permit + native-fswrite: filename match "/var/spool/lpd/*" then permit + native-ftruncate: permit + native-getdirentries: permit + native-getegid: permit + native-geteuid: permit + native-getpid: permit + native-gettimeofday: permit + native-issetugid: permit + native-kill: permit + native-listen: permit + native-lseek: permit + native-mmap: permit + native-mprotect: permit + native-munmap: permit + native-pread: permit + native-read: permit + native-recvfrom: permit + native-select: permit + native-sendto: permit + native-setegid: gid eq "1" then permit + native-setegid: permit + native-seteuid: uid eq "0" then permit + native-seteuid: uid eq "1" then permit + native-setpgid: permit + native-setsid: permit + native-sigaction: permit + native-sigprocmask: permit + native-sigreturn: permit + native-socket: permit + native-umask: permit + native-wait4: permit + native-write: permit |