On Tue, 24 Oct 2000, Thor Lancelot Simon wrote:

> On Tue, Oct 24, 2000 at 11:05:38AM -0400, Jon Lindgren wrote:
> > I began a discussion a day or so ago on port-sparc and netbsd-help
> > regarding setting up a firewall with r/o local disks (specifically, using
> > a CD to boot, and allowing _no_ local writes to the disk).
> > 
> > After many suggestions on how to accomplish this, a suggestion was made as
> > to a theoretical securelevel 3 where not much at all can be changed (no
> > ipf rules added, etc...).
> 
> I don't at all understand what's "theoretical" about this, or what
> enhancements would be rquired.  The policy enforced at securelevel 
> 2 was designed and implemented *specifically* for this purpose and
> AFAICT works fine.  If you don't understand how to use it to achieve your
> goal, I suggest that you really shouldn't be tinkering with the system's
> security model.

Then I definitely don't know exactly what securelevel 2 is.  Is there a
spot to read up on exactly what it does and what it affects?

Thanks.

-Jon
 --------------------------------------------------------------------
 "Trout are freshwater fish, and have underwater weapons."
 "Zing, zing zing zing!"
 "Keep away from the trout."
 -- The opinions expressed are not necesarily those of my employer --
 "Who stole my lawn?"