os/doc
3
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

- Merge the following from the English version:

Browse source 
r15267 -> r15428	head/ja_JP.eucJP/books/handbook/security/chapter.xml
This commit is contained in:
Ryusuke SUZUKI 2013-11-07 11:57:57 +00:00
parent c057dbfa2b
commit 4e968cced8
Notes: svn2git 2020-12-08 03:00:23 +00:00 
svn path=/head/; revision=43116
svn path=/release/PRE_DOCBOOK50/; revision=43123; tag=PRE_DOCBOOK50
1 changed files with 4 additions and 75 deletions
Download patch file Download diff file Expand all files Collapse all files

79
ja_JP.eucJP/books/handbook/security/chapter.xml
View file

@ -3,9 +3,7 @@
The FreeBSD Documentation Project
The FreeBSD Japanese Documentation Project
Original revision: r15267
Waiting for: 1.123 or mac/chapter.xml
("mac" referenced from disks).
Original revision: r15428
Translation note: "fs-acl" section added in rev.1.118 is moved to
handbook/basics in rev.1.134 and moved back to this file in
rev.1.150. The traslation is already done in handbook/basics, so we
@ -81,11 +79,6 @@
<para>FreeBSD で使われている SSH 実装である
OpenSSH の設定および使用方法</para>
</listitem>
<listitem>
<para>拡張されたファイルシステムアクセス制御リスト
(ACL) の UFS での設定および使用方法</para>
</listitem>
<!--
<listitem>
<para>How to configure and load access control extension
@ -3807,70 +3800,6 @@ user@unfirewalled.myserver.com's password: <userinput>*******</userinput></scree
<para>&man.sshd.8; &man.sftp-server.8;</para>
</sect2>
</sect1>
<!-- XXX 2006/05/01 hiroo: Do not translate this section.
See the translation note in the header for the reason.
<sect1 id="fs-acl">
<sect1info>
<authorgroup>
<author>
<firstname>Tom</firstname>
<surname>Rhodes</surname>
<contrib>Contributed by </contrib>
</author>
</authorgroup>
</sect1info>
<indexterm>
<primary>ACL</primary>
</indexterm>
<title>File System Access Control Lists</title>
<para>In conjunction with file system enhancements like snapshots, FreeBSD 5.0
and later offers the security of File System Access Control Lists
(<acronym>ACLs</acronym>).</para>
<para>Access Control Lists extend the standard UNIX
permission model in a highly compatible (POSIX.1e) way. This feature
permits an administrator to make use of and take advantage of a
more sophisticated security model.</para>
<para>For <acronym>ACLs</acronym> to work:</para>
<programlisting>options UFS_ACL</programlisting>
<para>must be compiled into the kernel. If this option has
not been compiled in, a warning message will be displayed
when attempting to mount a file system sporting <acronym>ACLs</acronym>.
<acronym>ACLs</acronym> rely on extended attributes being enabled on
the file system. This is supported natively in the next generation of
the <acronym>UNIX</acronym> file system or <acronym>UFS2</acronym>.</para>
<note><para>The use of extended attributes on <acronym>UFS1</acronym> file
systems will lead to higher administration overhead and lower overall
file system performance. <acronym>UFS2</acronym> does not have this
problem.</para></note>
<para>To enable <acronym>ACLs</acronym> on a file system, the <option>-a</option>
option can be passed to &man.tunefs.8; in a manner similar to the Soft Updates
process:</para>
<screen>&prompt.root; <userinput>umount /usr</userinput>
&prompt.root; <userinput>tunefs -a enable /dev/<replaceable>diskNsNx</replaceable></userinput>
&prompt.root; <userinput>mount /dev/<replaceable>diskNsNx</replaceable> /usr</userinput></screen>
<para>This assumes that <devicename>/dev/<replaceable>diskNsNx</replaceable></devicename> is the
<filename>/usr</filename> partition.</para>
<para><acronym>ACLs</acronym> can also be enabled by passing the
<option>-o acls</option> argument to &man.mount.8;:</para>
<screen>&prompt.root; <userinput>mount -o acls /dev/<replaceable>diskNsNx</replaceable> /usr</userinput></screen>
<para>This flag can also be set in <filename>/etc/fstab</filename>.
It is recommended to use the former over the latter to avoid remount
issues with the root file system.</para>
</sect1>
-->
<!--
<sect1 id="mac">
<sect1info>
@ -3956,7 +3885,7 @@ user@unfirewalled.myserver.com's password: <userinput>*******</userinput></scree
<primary>TCB</primary>
</indexterm>
<para>The Biba Integrity Policy (&man.mac.biba.4;) provides
for hierarchal and non-hierarchal labeling of all system
for hierarchical and non-hierarchical labeling of all system
objects with integrity data, and the strict enforcement of
an information flow policy to prevent corruption of high
integrity subjects and data by low-integrity subjects.
@ -4048,7 +3977,7 @@ user@unfirewalled.myserver.com's password: <userinput>*******</userinput></scree
<para>Module name: mac_mls.ko</para>
<para>Kernel option: <literal>MAC_MLS</literal></para>
<para>Multi-Level Security (<acronym>MLS</acronym>)
(&man.mac.mls.4;) provides for hierarchal and non-hierarchal
(&man.mac.mls.4;) provides for hierarchical and non-hierarchical
labeling of all system objects with sensitivity data, and the
strict enforcement of an information flow policy to prevent
the leakage of confidential data to untrusted parties. The
@ -4057,7 +3986,7 @@ user@unfirewalled.myserver.com's password: <userinput>*******</userinput></scree
trusted operating systems to protect data secrecy in
multi-user environments. Hierarchal labels provide support
for the notion of clearances and classifications in
traditional parlance; non-hierarchal labels provide support
traditional parlance; non-hierarchical labels provide support
for <quote>need-to-know.</quote> As with Biba, ubiquitous
labeling of objects occurs, and it must therefore be compiled
into the kernel or loaded at boot. As with Biba, extensive