A separate location for the web data which users
must be capable of accessing will be appointed. This
will permit biba/high
processes access
rights to the web data.
Begin by creating a directory to store the web data in:
#
mkdir /usr/home/cvs
Now initialize it with cvs
:
#
cvs -d /usr/home/cvs init
The first goal is to enable the biba
policy, thus the mac_biba_enable="YES"
should be placed in
/boot/loader.conf
. This assumes
that support for MAC has been enabled
in the kernel.
From this point on everything in the system should
be set at biba/high
by default.
The following modification must be made to the
login.conf
file, under the default
user class:
Every user should now be placed in the default class; a command such as:
#
for x in `awk -F: '($3 >= 1001) && ($3 != 65534) { print $1 }' \
/etc/passwd`; do pw usermod $x -L default; done;
will accomplish this task in a few moments.
Now create another class, web, a copy of default,
with the label setting of biba/low
.
Create a user who will be used to work with the
main web data stored in a cvs
repository. This user must be placed in our new login
class, web
.
Since the default is biba/high
everywhere, the repository will be the same. The web data must
also be the same for users to have read/write access to it;
however, since our web server will be serving data that
biba/high
users must access, we will need to
downgrade the data as a whole.
The perfect tools for this are sh(1) and cron(8) and are already provided in FreeBSD. The following script should do everything we want:
In many cases the cvs
Id tags must be placed into the web
site data files.
This script may now be placed into
web
's home directory and the following
crontab(1) entry added:
This will check out the HTML sources every twelve hours on the machine.
The default startup method for the web server must also be
modified to start the process as biba/low
.
This can be done by making the following modification to the
/usr/local/etc/rc.d/apache.sh
script:
The Apache configuration must be
altered to work with the biba/low
policy. In
this case the software must be configured to append to the
log files in a directory set at biba/low
or else access denied errors will be
returned.
Following this example requires that the
docroot
directive be set to
/home/web/htdocs
; otherwise,
Apache will fail when trying
to locate the directory to serve documents from.
Other configuration variables must be altered as well,
including the PID file,
Scoreboardfile
,
DocumentRoot
, log file locations, or any
other variable which requires write access.
When using biba
, all write access will be
denied to the server in areas not set at
biba/low
.
本文及其他文件,可由此下載: ftp://ftp.FreeBSD.org/pub/FreeBSD/doc/。
若有 FreeBSD 方面疑問,請先閱讀
FreeBSD 相關文件,如不能解決的話,再洽詢
<questions@FreeBSD.org>。
關於本文件的問題,請洽詢
<doc@FreeBSD.org>。