xref: /openbsd-src/share/man/man7/securelevel.7 (revision e98b8f77d81890c591d7cfdb77c356776389ed1b)
1.\"     $OpenBSD: securelevel.7,v 1.22 2009/05/09 13:45:28 sthen Exp $
2.\"
3.\" Copyright (c) 2000 Hugh Graham
4.\"
5.\" Redistribution and use in source and binary forms, with or without
6.\" modification, are permitted provided that the following conditions
7.\" are met:
8.\" 1. Redistributions of source code must retain the above copyright
9.\"    notice, this list of conditions and the following disclaimer.
10.\" 2. Redistributions in binary form must reproduce the above copyright
11.\"    notice, this list of conditions and the following disclaimer in the
12.\"    documentation and/or other materials provided with the distribution.
13.\"
14.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
15.\" WARRANTIES, INCLUDING, BUT NOT LIMITED TO, IMPLIED WARRANTIES OF
16.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17.\" IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
18.\" INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
19.\" (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
20.\" SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
22.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
23.\" IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
24.\" POSSIBILITY OF SUCH DAMAGE.
25.\"
26.Dd $Mdocdate: May 9 2009 $
27.Dt SECURELEVEL 7
28.Os
29.Sh NAME
30.Nm securelevel
31.Nd securelevel and its effects
32.Sh DESCRIPTION
33The
34.Ox
35kernel provides four levels of system security:
36.Bl -tag -width flag
37.It \&-1 Em Permanently insecure mode
38.Bl -hyphen -compact
39.It
40.Xr init 8
41will not attempt to raise the securelevel
42.It
43may only be set with
44.Xr sysctl 8
45while the system is insecure
46.It
47otherwise identical to securelevel 0
48.El
49.It \ 0 Em Insecure mode
50.Bl -hyphen -compact
51.It
52used during bootstrapping and while the system is single-user
53.It
54all devices may be read or written subject to their permissions
55.It
56system file flags may be cleared with
57.Xr chflags 2
58.El
59.It \ 1 Em Secure mode
60.Bl -hyphen -compact
61.It
62default mode when system is multi-user
63.It
64securelevel may no longer be lowered except by init
65.It
66.Pa /dev/mem
67and
68.Pa /dev/kmem
69may not be written to
70.It
71raw disk devices of mounted file systems are read-only
72.It
73system immutable and append-only file flags may not be removed
74.It
75kernel modules may not be loaded or unloaded
76.It
77the
78.Va fs.posix.setuid
79.Xr sysctl 8
80variable may not be changed
81.It
82the
83.Va net.inet.ip.sourceroute
84.Xr sysctl 8
85variable may not be changed
86.It
87the
88.Va machdep.kbdreset
89.Xr sysctl 8
90variable may not be changed
91.It
92the
93.Va ddb.console
94and
95.Va ddb.panic
96.Xr sysctl 8
97variables may not be raised
98.It
99the
100.Va machdep.allowaperture
101.Xr sysctl 8
102variable may not be raised
103.It
104.Xr gpioctl 8
105may only access GPIO pins configured at system startup
106.El
107.It \ 2 Em Highly secure mode
108.Bl -hyphen -compact
109.It
110all effects of securelevel 1
111.It
112raw disk devices are always read-only whether mounted or not
113.It
114.Xr settimeofday 2
115and
116.Xr clock_settime 2
117may not set the time backwards or close to overflow
118.It
119.Xr pf 4
120filter and NAT rules may not be altered
121.El
122.El
123.Pp
124Securelevel provides convenient means of
125.Dq locking down
126a system to a degree suited to its environment.
127It is normally set at boot via the
128.Xr rc.securelevel 8
129script, or the superuser may raise securelevel at any time by modifying the
130.Va kern.securelevel
131.Xr sysctl 8
132variable.
133However, only
134.Xr init 8
135may lower it once the system has entered secure mode.
136A kernel built with
137.Cm option INSECURE
138in the config file will default to permanently insecure mode.
139.Pp
140Highly secure mode may seem Draconian, but is intended as a last line of
141defence should the superuser account be compromised.
142Its effects preclude
143circumvention of file flags by direct modification of a raw disk device,
144or erasure of a file system by means of
145.Xr newfs 8 .
146Further, it can limit the potential damage of a compromised
147.Dq firewall
148by prohibiting the modification of packet filter rules.
149Preventing
150the system clock from being set backwards aids in post-mortem analysis
151and helps ensure the integrity of logs.
152Precision timekeeping is not
153affected because the clock may still be slowed.
154.Pp
155Because securelevel can be modified with the in-kernel debugger
156.Xr ddb 4 ,
157a convenient means of locking it off (if present) is provided
158at securelevels 1 and 2.
159This is accomplished by setting
160.Va ddb.console
161and
162.Va ddb.panic
163to 0 with the
164.Xr sysctl 8
165utility.
166.Sh FILES
167.Bl -tag -width /etc/rc.securelevel -compact
168.It Pa /etc/rc.securelevel
169commands that run before the security level changes
170.El
171.Sh SEE ALSO
172.Xr options 4 ,
173.Xr init 8 ,
174.Xr rc 8 ,
175.Xr sysctl 8
176.Sh HISTORY
177The
178.Nm
179manual page first appeared in
180.Ox 2.6 .
181.Sh BUGS
182The list of securelevel's effects may not be comprehensive.
183