blob: a9717ee71954f4b4876d2b6c2e2b9f6e53e5a356 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
|
Simple MAC framework policy to disable access to networking for
certain group. Running kldload mac_nonet.ko to load the kernel
module. The load action require root permissions.
Set gid that shouldn't access the network:
sysctl security.mac.nonet.gid=31337
and enable enforcing:
sysctl security.mac.nonet.enabled=1
Any call to socket(2) from user in this group will end with EPERM.
You can also select group that can access only AF_UNIX sockets with
security.mac.nonet.local_gid.
|
