Return to securelevel.7 CVS log

Up to [local] / src / share / man / man7

sysctl(2): add kern.utc_offset: successor to the DST/TIMEZONE options(4)

The DST and TIMEZONE options(4) are incompatible with KARL, so we need
some other way to compensate for an RTC running with a known offset.

Enter kern.utc_offset, an offset in minutes East of UTC.  TIMEZONE has
always been minutes West, but this is inconsistent with how everyone
else talks about timezones, hence the flip.

TIMEZONE has the advantage of being compiled into the binary.  Our new
sysctl(2) has no such luck, so it needs to be set as early as possible
in boot, from sysctl.conf(5), so we can correct the kernel clock from
the RTC's local time to UTC before daemons like ntpd(8) and cron(8)
start.  To encourage this, kern.utc_offset is made immutable after the
securelevel(7) is raised to 1.

Prompted by yasuoka@.  Discussed with deraadt@, kettenis@, yasuoka@.
Additional testing by yasuoka@.

ok deraadt@, yasuoka@

.\"     $OpenBSD: securelevel.7,v 1.31 2019/08/21 20:44:09 cheloha Exp $
.\"
.\" Copyright (c) 2000 Hugh Graham
.\"
.\" Redistribution and use in source and binary forms, with or without
.\" modification, are permitted provided that the following conditions
.\" are met:
.\" 1. Redistributions of source code must retain the above copyright
.\"    notice, this list of conditions and the following disclaimer.
.\" 2. Redistributions in binary form must reproduce the above copyright
.\"    notice, this list of conditions and the following disclaimer in the
.\"    documentation and/or other materials provided with the distribution.
.\"
.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
.\" WARRANTIES, INCLUDING, BUT NOT LIMITED TO, IMPLIED WARRANTIES OF
.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
.\" IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
.\" INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
.\" (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
.\" SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
.\" IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
.\" POSSIBILITY OF SUCH DAMAGE.
.\"
.Dd $Mdocdate: August 21 2019 $
.Dt SECURELEVEL 7
.Os
.Sh NAME
.Nm securelevel
.Nd securelevel and its effects
.Sh DESCRIPTION
The
.Ox
kernel provides four levels of system security:
.Bl -tag -width flag
.It \&-1 Em Permanently insecure mode
.Bl -hyphen -compact
.It
.Xr init 8
will not attempt to raise the securelevel
.It
may only be set with
.Xr sysctl 8
while the system is insecure
.It
otherwise identical to securelevel 0
.El
.It \ 0 Em Insecure mode
.Bl -hyphen -compact
.It
used during bootstrapping and while the system is single-user
.It
all devices may be read or written subject to their permissions
.It
system file flags may be cleared with
.Xr chflags 2
.El
.It \ 1 Em Secure mode
.Bl -hyphen -compact
.It
default mode when system is multi-user
.It
securelevel may no longer be lowered except by init
.It
.Pa /dev/mem
and
.Pa /dev/kmem
cannot be opened
.It
raw disk devices of mounted file systems are read-only
.It
system immutable and append-only file flags may not be removed
.It
the
.Va fs.posix.setuid ,
.Va hw.allowpowerdown ,
.Va kern.allowkmem ,
.Va kern.utc_offset ,
.Va net.inet.ip.sourceroute ,
and
.Va machdep.kbdreset
.Xr sysctl 8
variables may not be changed
.It
the
.Va ddb.console ,
.Va ddb.panic ,
and
.Va machdep.allowaperture
.Xr sysctl 8
variables may not be raised
.It
.Xr gpioctl 8
may only access GPIO pins configured at system startup
.El
.It \ 2 Em Highly secure mode
.Bl -hyphen -compact
.It
all effects of securelevel 1
.It
raw disk devices are always read-only whether mounted or not
.It
.Xr settimeofday 2
and
.Xr clock_settime 2
may not set the time backwards or close to overflow
.It
.Xr pf 4
filter and NAT rules may not be altered
.El
.El
.Pp
Securelevel provides convenient means of
.Dq locking down
a system to a degree suited to its environment.
It is normally set at boot by
.Xr rc 8 ,
or the superuser may raise securelevel at any time by modifying the
.Va kern.securelevel
.Xr sysctl 8
variable.
However, only
.Xr init 8
may lower it once the system has entered secure mode.
.Pp
Highly secure mode may seem Draconian, but is intended as a last line of
defence should the superuser account be compromised.
Its effects preclude
circumvention of file flags by direct modification of a raw disk device,
or erasure of a file system by means of
.Xr newfs 8 .
Further, it can limit the potential damage of a compromised
.Dq firewall
by prohibiting the modification of packet filter rules.
Preventing
the system clock from being set backwards aids in post-mortem analysis
and helps ensure the integrity of logs.
Precision timekeeping is not
affected because the clock may still be slowed.
.Pp
Because securelevel can be modified with the in-kernel debugger
.Xr ddb 4 ,
a convenient means of locking it off (if present) is provided
at securelevels 1 and 2.
This is accomplished by setting
.Va ddb.console
and
.Va ddb.panic
to 0 with the
.Xr sysctl 8
utility.
.Sh FILES
.Bl -tag -width /etc/rc.securelevel -compact
.It Pa /etc/rc.securelevel
commands that run before the security level changes
.El
.Sh SEE ALSO
.Xr init 8 ,
.Xr rc 8 ,
.Xr sysctl 8
.Sh HISTORY
The
.Nm
manual page first appeared in
.Ox 2.6 .
.Sh BUGS
The list of securelevel's effects may not be comprehensive.