svn commit: r288390 - head/etc/rc.d

[Bryan Drewery]

Author: bdrewery
Date: Tue Sep 29 18:51:56 2015
New Revision: 288390
URL: https://svnweb.freebsd.org/changeset/base/288390

Log:
  When stopping ugidfw, it is not enough to just try unloading the module.  If
  the module is built-in to the kernel then the kldunload will fail.  Rather
  than do this just check if there are rules and then remove them all.
  
  Add requirement on FILESYSTEMS to ensure /usr is present for /usr/sbin/ugidfw
  and /usr/bin/xargs.  This was already effectively the ordering from rcorder(8).
  
  MFC after:	2 weeks
  Relnotes:	yes

Modified:
  head/etc/rc.d/ugidfw

Modified: head/etc/rc.d/ugidfw
==============================================================================
--- head/etc/rc.d/ugidfw	Tue Sep 29 18:48:12 2015	(r288389)
+++ head/etc/rc.d/ugidfw	Tue Sep 29 18:51:56 2015	(r288390)
@@ -3,6 +3,7 @@
 # $FreeBSD$
 
 # PROVIDE: ugidfw
+# REQUIRE: FILESYSTEMS
 # BEFORE: LOGIN
 # KEYWORD: nojail shutdown
 
@@ -33,9 +34,17 @@ ugidfw_start()
 
 ugidfw_stop()
 {
+	local rulecount
+
 	# Disable the policy
 	#
-	kldunload mac_bsdextended
+	# Check for the existence of rules and flush them if needed.
+	rulecount=$(sysctl -in security.mac.bsdextended.rule_count)
+	if [ ${rulecount:-0} -gt 0 ]; then
+		ugidfw list | sed -n '2,$p' | cut -d ' ' -f 1 | sort -r -n |
+		    xargs -n 1 ugidfw remove
+		echo "MAC bsdextended rules flushed."
+	fi
 }
 
 load_rc_config $name