Move DESIGN and README to root directory.
This commit is contained in:
parent
b2daf09c10
commit
15f6bb66ee
@ -1,4 +1,4 @@
|
||||
ifchd, copyright (c) 2004 Nicholas Kain. Licensed under GNU GPL.
|
||||
ifchd, copyright (c) 2004-2010 Nicholas Kain. Licensed under GNU GPL.
|
||||
|
||||
Requirements:
|
||||
|
||||
@ -11,9 +11,7 @@ C99-compliant C compiler (for C99 struct subobject init)
|
||||
Tested with glibc 2.2.x and 2.3.x. dietlibc is not compatible. I have not yet
|
||||
tested uclibc.
|
||||
|
||||
I may bother to port to other operating systems, but don't count on it. Other
|
||||
OSes lack the functionality of a [RSBAC|SELinux]+PaX enabled kernel, so I find
|
||||
them to be less useful for a highly secured system.
|
||||
I may bother to port to other operating systems, but don't count on it.
|
||||
|
||||
INTRODUCTION
|
||||
------------
|
||||
@ -138,22 +136,6 @@ ifchd can be set such that it only allows clients to configure particular
|
||||
network interfaces. The --interface (-i) argument does the trick, and may
|
||||
be used multiple times to allow multiple interfaces.
|
||||
|
||||
RSBAC NOTES
|
||||
-----------
|
||||
|
||||
I was personally unable to get ifchd to properly function with RSBAC_NET_DEV
|
||||
enabled. Browsing the rsbac source, I was unable to figure out what I was
|
||||
doing incorrectly -- my RC definitions were as far as I could tell, correct.
|
||||
Therefore, my directions assume that you have disabled RSBAC_NET_DEV in your
|
||||
kernel configuration.
|
||||
|
||||
The normal usage directions may be followed, but an additional step for rsbac
|
||||
is necessary. Change to your secoff account and invoke rsbac_fd_menu on the
|
||||
ifchd and ndhc executables. The AUTH capability for your ifchd and dhcp groups
|
||||
must be allowed on the corresponding executables, otherwise ifchd and ndhc will
|
||||
be unable to change to a non-root user and will refuse to run.
|
||||
|
||||
|
||||
GRSECURITY NOTES
|
||||
----------------
|
||||
|
||||
@ -188,4 +170,3 @@ nonstandard semantics (notably Solaris). On these systems, using the
|
||||
system-provided implementations may lead to security problems. Such problems
|
||||
are the fault of the vendor. If you are unsure whether your system is correct
|
||||
or not, I suggest using the implementation that I provide.
|
||||
|
Loading…
Reference in New Issue
Block a user