1 files changed, 139 insertions, 0 deletions
diff --git a/static/netbsd/man9/secmodel_extensions.9 b/static/netbsd/man9/secmodel_extensions.9
new file mode 100644
index 00000000..c5cc6766
--- /dev/null
+++ b/static/netbsd/man9/secmodel_extensions.9
@@ -0,0 +1,139 @@
+.\" $NetBSD: secmodel_extensions.9,v 1.7 2022/03/27 16:36:11 christos Exp $
+.\"
+.\" Copyright (c) 2011 The NetBSD Foundation, Inc.
+.\" All rights reserved.
+.\"
+.\" This code is derived from software contributed to The NetBSD Foundation
+.\" by Jean-Yves Migeon <jym@NetBSD.org>
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\"    notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\"    notice, this list of conditions and the following disclaimer in the
+.\"    documentation and/or other materials provided with the distribution.
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
+.\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+.\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+.\" PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
+.\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+.\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+.\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+.\" POSSIBILITY OF SUCH DAMAGE.
+.\"
+.Dd March 27, 2022
+.Dt SECMODEL_EXTENSIONS 9
+.Os
+.Sh NAME
+.Nm secmodel_extensions
+.Nd extensions security model
+.Sh DESCRIPTION
+.Nm
+implements extensions to the traditional security model based on
+the original
+.Bx 4.4 .
+They can be used to grant additional privileges to ordinary users, or
+enable specific security measures like curtain mode.
+.Pp
+The extensions are described below.
+.Sh Curtain mode
+When enabled, all returned objects will be filtered according to
+the user-id requesting information about them, preventing users from
+accessing objects they do not own.
+.Pp
+It affects the output of many commands, including
+.Xr fstat 1 ,
+.Xr netstat 1 ,
+.Xr ps 1 ,
+.Xr sockstat 1 ,
+and
+.Xr w 1 .
+.Pp
+This extension is enabled by setting
+.Pa security.models.extensions.curtain
+or
+.Pa security.curtain
+.Xr sysctl 7
+to a non-zero value.
+.Pp
+It can be enabled at any time, but cannot be disabled
+anymore when the
+.Em securelevel
+of the system is above 0.
+.Sh Non-superuser mounts
+When enabled, it allows file-systems to be mounted by an ordinary user
+who owns the point
+.Ar node
+and has at least read access to the
+.Ar special
+device
+.Xr mount 8
+arguments.
+Note that the
+.Cm nosuid
+and
+.Cm nodev
+flags must be given for non-superuser mounts.
+.Pp
+This extension is enabled by setting
+.Pa security.models.extensions.usermount
+or
+.Pa vfs.generic.usermount
+.Xr sysctl 7
+to a non-zero value.
+.Pp
+It can be disabled at any time, but cannot be enabled
+anymore when the
+.Em securelevel
+of the system is above 0.
+.Sh Non-superuser control of CPU sets
+When enabled, an ordinary user is allowed to control the CPU
+.Xr affinity 3
+of the processes and threads they own.
+.Pp
+This extension is enabled by setting
+.Pa security.models.extensions.user_set_cpu_affinity
+.Xr sysctl 7
+to a non-zero value.
+.Pp
+It can be disabled at any time, but cannot be enabled
+anymore when the
+.Em securelevel
+of the system is above 0.
+.Sh Hardlink restrictions
+Prevent hardlinks to files that the user does not own or has group access
+to.
+.Pp
+To enable user ownership checks, set the
+.Xr sysctl 7
+variable
+.Pa security.models.extensions.hardlink_check_uid
+to a non-zero value.
+.Pp
+To enable group membership checks, set the
+.Xr sysctl 7
+variable
+.Pa security.models.extensions.hardlink_check_gid
+to a non-zero value.
+.Pp
+These variables can be enabled anytime, but cannot be disabled
+anymore when the
+.Em securelevel
+of the system is above 0.
+.Sh SEE ALSO
+.Xr affinity 3 ,
+.Xr sched 3 ,
+.Xr sysctl 7 ,
+.Xr kauth 9 ,
+.Xr secmodel 9 ,
+.Xr secmodel_bsd44 9 ,
+.Xr secmodel_securelevel 9 ,
+.Xr secmodel_suser 9
+.Sh AUTHORS
+.An Elad Efrat Aq Mt elad@NetBSD.org