Bug 219376 - [NEW PORT] sysutils/mac_nonet: Simple MAC framework policy to disable access to networking for certain group
Summary: [NEW PORT] sysutils/mac_nonet: Simple MAC framework policy to disable access ...
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Only Me
Assignee: Tobias Kortkamp
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-05-18 12:10 UTC by Jov
Modified: 2018-03-12 07:06 UTC (History)
2 users (show)

See Also:

Attachments
new port shar file (1.99 KB, text/plain)
2017-05-18 12:10 UTC, Jov 		no flags Details
mac_nonet.shar (1.97 KB, text/plain)
2017-05-26 06:15 UTC, Jov 		no flags Details
Show Obsolete (1) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Jov 2017-05-18 12:10:52 UTC 
Created attachment 182693 [details]
new port shar file

Simple MAC framework policy to disable access to networking for certain group.
Running kldload mac_nonet.ko to load the kernel module. The load action require
root permissions. Set gid that shouldn't access the network: 
    sysctl security.mac.nonet.gid=31337
and enable enforcing:
     sysctl security.mac.nonet.enabled=1
Any call to socket(2) from user in this group will end with EPERM. You can also
select group that can access only AF_UNIX sockets with
security.mac.nonet.local_gid.

WWW: https://github.com/pbiernacki/mac_nonet
Comment 1 Baptiste Daroussin freebsd_committer freebsd_triage 2017-05-25 21:04:54 UTC 
Comment on attachment 182693 [details]
new port shar file

GH_PROJECT is not needed
This is a kernel module, it should use USES=kmod
Comment 2 Jov 2017-05-26 06:15:38 UTC 
Created attachment 182921 [details]
mac_nonet.shar

GH_PROJECT is not needed---fixed
This is a kernel module, it should use USES=kmod----fixed
Comment 3 Jov 2017-06-20 01:09:46 UTC 
ping
Comment 4 Jov 2017-06-20 01:12:52 UTC 
ping
Comment 5 Tobias Kortkamp freebsd_committer freebsd_triage 2018-03-12 07:05:48 UTC 
Committed. Thanks!

And once again apologies that this took so long!
Comment 6 commit-hook freebsd_committer freebsd_triage 2018-03-12 07:06:19 UTC 
A commit references this bug:

Author: tobik
Date: Mon Mar 12 07:05:25 UTC 2018
New revision: 464226
URL: https://svnweb.freebsd.org/changeset/ports/464226

Log:
  New port: sysutils/mac_nonet

  Simple MAC framework policy to disable access to networking for
  certain group.  Running kldload mac_nonet.ko to load the kernel
  module.  The load action require root permissions.

  Set gid that shouldn't access the network:
      sysctl security.mac.nonet.gid=31337
  and enable enforcing:
       sysctl security.mac.nonet.enabled=1

  Any call to socket(2) from user in this group will end with EPERM.
  You can also select group that can access only AF_UNIX sockets with
  security.mac.nonet.local_gid.

  WWW: https://github.com/pbiernacki/mac_nonet

  PR:		219376
  Submitted by:	amutu@amutu.com
  Reviewed by:	bapt

Changes:
  head/sysutils/Makefile
  head/sysutils/mac_nonet/
  head/sysutils/mac_nonet/Makefile
  head/sysutils/mac_nonet/distinfo
  head/sysutils/mac_nonet/pkg-descr