When stopping ugidfw, it is not enough to just try unloading the module. If

the module is built-in to the kernel then the kldunload will fail.  Rather
than do this just check if there are rules and then remove them all.

Add requirement on FILESYSTEMS to ensure /usr is present for /usr/sbin/ugidfw
and /usr/bin/xargs.  This was already effectively the ordering from rcorder(8).

MFC after:	2 weeks
Relnotes:	yes

diff --git a/etc/rc.d/ugidfw b/etc/rc.d/ugidfw
index d65d6a3633a6fa7d2ff123c54116d20cdf4f8bec..09171e492b1f7f6a56430d365304c7b4d82b8c54 100755 (executable)
--- a/etc/rc.d/ugidfw
+++ b/etc/rc.d/ugidfw
@@ -3,6 +3,7 @@
 # $FreeBSD$
 
 # PROVIDE: ugidfw
+# REQUIRE: FILESYSTEMS
 # BEFORE: LOGIN
 # KEYWORD: nojail shutdown
 
@@ -33,9 +34,17 @@ ugidfw_start()
 
 ugidfw_stop()
 {
+       local rulecount
+
        # Disable the policy
        #
-       kldunload mac_bsdextended
+       # Check for the existence of rules and flush them if needed.
+       rulecount=$(sysctl -in security.mac.bsdextended.rule_count)
+       if [ ${rulecount:-0} -gt 0 ]; then
+               ugidfw list | sed -n '2,$p' | cut -d ' ' -f 1 | sort -r -n |
+                   xargs -n 1 ugidfw remove
+               echo "MAC bsdextended rules flushed."
+       fi
 }
 
 load_rc_config $name