Subject: Re: security sysctl? (was: r/o filesystem restrictions for firewall?)
To: None <,>
From: Thor Lancelot Simon <>
List: tech-kern
Date: 10/24/2000 13:36:47
On Tue, Oct 24, 2000 at 11:05:38AM -0400, Jon Lindgren wrote:
> I began a discussion a day or so ago on port-sparc and netbsd-help
> regarding setting up a firewall with r/o local disks (specifically, using
> a CD to boot, and allowing _no_ local writes to the disk).
> After many suggestions on how to accomplish this, a suggestion was made as
> to a theoretical securelevel 3 where not much at all can be changed (no
> ipf rules added, etc...).

I don't at all understand what's "theoretical" about this, or what
enhancements would be rquired.  The policy enforced at securelevel 
2 was designed and implemented *specifically* for this purpose and
AFAICT works fine.  If you don't understand how to use it to achieve your
goal, I suggest that you really shouldn't be tinkering with the system's
security model.

Thor Lancelot Simon	                            
	the effort to perceive simply the cruel radiance of what is