# # The following are some default rules for devfs(5) mounts. # The format is very simple. Empty lines and lines beginning # with a hash '#' are ignored. If the hash mark occurs anywhere # other than the beginning of a line, it and any subsequent # characters will be ignored. A line in between brackets '[]' # denotes the beginning of a ruleset. In the brackets should # be a name for the rule and its ruleset number. Any other lines # will be considered to be the 'action' part of a rule # passed to the devfs(8) command. These will be passed # "as-is" to the devfs(8) command with the exception that # any references to other rulesets will be expanded first. These # references must include a dollar sign '$' in front of the # name to be expanded properly. # # $FreeBSD$ # # Very basic and secure ruleset: Hide everything. # Used as a basis for other rules. # [devfsrules_hide_all=1] add hide # Basic devices typically necessary. # Requires: devfsrules_hide_all # [devfsrules_unhide_basic=2] add path null unhide add path zero unhide add path crypto unhide add path random unhide add path urandom unhide # Devices typically needed to support logged-in users. # Requires: devfsrules_hide_all # [devfsrules_unhide_login=3] add path 'ptyp*' unhide add path 'ptyq*' unhide add path 'ptyr*' unhide add path 'ptys*' unhide add path 'ptyP*' unhide add path 'ptyQ*' unhide add path 'ptyR*' unhide add path 'ptyS*' unhide add path 'ttyp*' unhide add path 'ttyq*' unhide add path 'ttyr*' unhide add path 'ttys*' unhide add path 'ttyP*' unhide add path 'ttyQ*' unhide add path 'ttyR*' unhide add path 'ttyS*' unhide add path ptmx unhide add path pts unhide add path 'pts/*' unhide add path fd unhide add path 'fd/*' unhide add path stdin unhide add path stdout unhide add path stderr unhide # Devices usually found in a jail. # [devfsrules_jail=4] add include $devfsrules_hide_all add include $devfsrules_unhide_basic add include $devfsrules_unhide_login [devfsrules_unhide_audio=5] add path 'audio*' unhide add path 'dsp*' unhide add path midistat unhide add path 'mixer*' unhide add path 'music*' unhide add path 'sequencer*' unhide add path sndstat unhide add path speaker unhide [devfsrules_unhide_printers=6] add path 'lpt*' unhide add path 'ulpt*' unhide add path 'unlpt*' unhide [devfsrules_unhide_input=7] add path 'atkbd*' unhide add path 'kbd*' unhide add path 'joy*' unhide add path 'psm*' unhide add path sysmouse unhide add path 'ukbd*' unhide add path 'ums*' unhide [devfsrules_unhide_xorg=8] add path agpgart unhide #add path console unhide add path dri unhide add path 'dri*' unhide add path io unhide add path mem unhide #add path pci unhide add path tty unhide add path ttyv0 unhide add path ttyv1 unhide add path ttyv8 unhide [devfsrules_unhide_cddvd=9] add path 'da*' unhide add path 'cd*' unhide add path 'cd*' mode 0666 add path 'pass*' unhide add path 'xpt*' unhide add path 'acd*' unhide add path 'acd*' mode 0666 [devfsrules_unhide_kmem=10] add path kmem unhide # # This allows to run a desktop system in a jail. Think about what you want to # achieve before you use this, it opens up the entire machine to access from # this jail to any sophisticated program. # [devfsrules_jail_desktop=11] add include $devfsrules_hide_all add include $devfsrules_unhide_basic add include $devfsrules_unhide_login add include $devfsrules_unhide_audio add include $devfsrules_unhide_input add include $devfsrules_unhide_xorg add include $devfsrules_unhide_cddvd add include $devfsrules_unhide_kmem