TrustedBSD Mandatory Access Control
reddit / freebsd

----------------------------------------------------------------------
Elias_Caplan · 2021-06-09 10:09

I'm trying to figure out how to implement the TrustedBSD Mandatory
Access Control for FreeBSD. I have a fresh install already but don't
know where to go from here. I looked at the documentation but it
doesn't necessarily say on what to do first. Also new to FreeBSD so it
makes it a lot harder on where to go from here. Any help is
appreciated.

----------------------------------------------------------------------
sopi20 · 2021-06-09 11:55

depends on what you are trying to accomplish - e.g. for filesystem
firewalling as a jumpstart you would place

`ugidfw_enable="YES"`
`bsdextended_script="/etc/rc.bsdextended"`

into your /etc/rc.conf file, and

`security.mac.bsdextended.enabled=1`
`security.mac.bsdextended.firstmatch_enabled=1`

into your /etc/sysctl.conf file and configure your filesystem firewall
rules in /etc/rc.bsdextended file (and reboot, or just run
/etc/rc.d/sysctl restart and /etc/rc.d/ugidfw start)

I really recommend you to read [FreeBSD Handbook - Chapter 16.
Mandatory Access
Control](https://docs.freebsd.org/en/books/handbook/mac/). Otherwise
you may end up with a pretty broken system while playing with it,
especially if you are new to FreeBSD at all.

----------------------------------------------------------------------
Elias_Caplan · 2021-06-09 12:01

That’s a good start, thank you. I want to learn specifically about the
MAC Multi-Level Security Module. I have looked at the documentation
and got some of it to work but that was mostly the 16.3 and 16.3.1
portion of the documentation but it really doesn’t break it down to
how you should do everything.