svn commit: r289249 - stable/10/etc/rc.d

[Bryan Drewery]

Author: bdrewery
Date: Tue Oct 13 18:46:11 2015
New Revision: 289249
URL: https://svnweb.freebsd.org/changeset/base/289249

Log:
  MFC r288390:
  
    When stopping ugidfw, it is not enough to just try unloading the module.  If
    the module is built-in to the kernel then the kldunload will fail.  Rather
    than do this just check if there are rules and then remove them all.
  
  Relnotes:	yes

Modified:
  stable/10/etc/rc.d/ugidfw
Directory Properties:
  stable/10/   (props changed)

Modified: stable/10/etc/rc.d/ugidfw
==============================================================================
--- stable/10/etc/rc.d/ugidfw	Tue Oct 13 18:44:55 2015	(r289248)
+++ stable/10/etc/rc.d/ugidfw	Tue Oct 13 18:46:11 2015	(r289249)
@@ -3,6 +3,7 @@
 # $FreeBSD$
 
 # PROVIDE: ugidfw
+# REQUIRE: FILESYSTEMS
 # BEFORE: LOGIN
 # KEYWORD: nojail shutdown
 
@@ -33,9 +34,17 @@ ugidfw_start()
 
 ugidfw_stop()
 {
+	local rulecount
+
 	# Disable the policy
 	#
-	kldunload mac_bsdextended
+	# Check for the existence of rules and flush them if needed.
+	rulecount=$(sysctl -in security.mac.bsdextended.rule_count)
+	if [ ${rulecount:-0} -gt 0 ]; then
+		ugidfw list | sed -n '2,$p' | cut -d ' ' -f 1 | sort -r -n |
+		    xargs -n 1 ugidfw remove
+		echo "MAC bsdextended rules flushed."
+	fi
 }
 
 load_rc_config $name