NAME

ocifbsd_security — ocifbsd security policy and resource-limit library

SYNOPSIS

#include <ocifbsd/security/rctl.h>
#include <ocifbsd/security/mac.h>

DESCRIPTION

The ocifbsd_security library implements the security policy and resource-limit primitives used by ocifbsd(8) to constrain and label containers and jails. It is not a standalone program; it is linked into the main ocifbsd(8) binary and any external tooling that needs to manage RCTL rules, MAC labels, or seccomp-equivalent sandboxing on FreeBSD jails.

The library provides three functional areas:

• Resource limits (rctl.c) drives the rctl(8) command to apply, query, and remove per-jail resource caps (memoryuse, openfiles, nproc, cputime, etc.) and translates the OCI Linux.resources JSON block into the equivalent FreeBSD RCTL rules.
• MAC framework (mac.c) manages the mac(4) labels that ocifbsd applies to jails, including Biba integrity labels, MLS sensitivity labels, and partition visibility labels. It can list, load, and unload MAC policy modules and parse the ‘jail -j jail label=...’ syntax.
• Seccomp shims (mac.c,) seccomp_load_profile(), seccomp_create_jail_filter(), seccomp_remove_filter(), seccomp_get_syscall_list() (currently stubs.) The real implementation will translate OCI seccomp profiles into capsicum(4) capability rights; see /usr/local/share/doc/ocifbsd/MIGRATION.md in the source tree for the full translation plan.

The public API is declared across <ocifbsd/security/rctl.h> and <ocifbsd/security/mac.h>; see those headers for the full list of functions and data structures.

FILES

/etc/ocifbsd/security.conf

Security defaults (default MAC policy, default RCTL action).

/var/run/ocifbsd/rctl/

Per-jail RCTL rule snapshots (human-readable, the format produced by rctl(8) -j jail).

SEE ALSO

ocifbsd(8), rctl(8), mac(4), capsicum(4), jail(8), biba(4), mls(4)

HISTORY

The ocifbsd_security library first appeared in FreeBSD 16.0.

AUTHORS

The ocifbsd_security library was developed by Klara, Inc. under sponsorship from