mac_igmpproxyMAC policy to run net/igmpproxy as a non-privileged user
1.0(package 1.0.1501000)sysutilsΣ=0 Package not present on quarterly.This port was created during this quarter. It will be in the next quarterly branch but not the current one.
A MAC framework policy that allows net/igmpproxy to run as an
unprivileged user.
It does so by granting the multicast routing privilege to a single
configurable UID, so igmpproxy can drop root after setting up its
sockets.
mac_igmpproxy needs to be loaded before igmpproxy starts, for example
by adding the following line to /boot/loader.conf:
mac_igmpproxy_load="YES"
Then make igmpproxy drop privileges by adding the following to
igmpproxy.conf:
user igmpproxy
chroot /var/empty
The policy applies to UID 422 (the igmpproxy user created by this
package) by default. This can be changed with:
sysctl security.mac.igmpproxy.uid=<uid>
and enforcement can be disabled with:
sysctl security.mac.igmpproxy.enabled=0
sysutils/mac_igmpproxy: New port, MAC policy for net/igmpproxy
A MAC framework policy that grants the multicast routing privilege to
a single configurable UID, so net/igmpproxy can drop root and run as
the new igmpproxy user (UID/GID 422). The policy can be tuned or
disabled with the security.mac.igmpproxy.uid and
security.mac.igmpproxy.enabled sysctls.
PR: 291647
