1.\" Copyright (c) 2003 Networks Associates Technology, Inc. 2.\" All rights reserved. 3.\" 4.\" This software was developed for the FreeBSD Project in part by Network 5.\" Associates Laboratories, the Security Research Division of Network 6.\" Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), 7.\" as part of the DARPA CHATS research program. 8.\" 9.\" Redistribution and use in source and binary forms, with or without 10.\" modification, are permitted provided that the following conditions 11.\" are met: 12.\" 1. Redistributions of source code must retain the above copyright 13.\" notice, this list of conditions and the following disclaimer. 14.\" 2. Redistributions in binary form must reproduce the above copyright 15.\" notice, this list of conditions and the following disclaimer in the 16.\" documentation and/or other materials provided with the distribution. 17.\" 18.\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND 19.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 20.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 21.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE 22.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 23.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 24.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 25.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 26.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 27.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 28.\" SUCH DAMAGE. 29.\" 30.Dd July 25, 2015 31.Dt MAC.CONF 5 32.Os 33.Sh NAME 34.Nm mac.conf 35.Nd format of the MAC library configuration file 36.Sh DESCRIPTION 37The 38.Nm 39file configures the default label elements to be used by policy-agnostic 40applications that operate on MAC labels. 41A file contains a series of default label sets specified by object class, 42in addition to blank lines and comments preceded by a 43.Ql # 44symbol. 45.Pp 46Currently, the implementation supports two syntax styles for label 47element declaration. 48The old (deprecated) syntax consists of a 49single line with two fields separated by white space: the object 50class name, and a list of label elements as used by the 51.Xr mac_prepare 3 52library calls prior to an application invocation of a function from 53.Xr mac_get 3 . 54.Pp 55The newer more preferred syntax consists of three fields separated by 56white space: the label group, object class name and a list of 57label elements. 58.Pp 59Label element names may optionally begin with a 60.Ql \&? 61symbol to indicate that a failure to retrieve the label element for 62an object should be silently ignored, and improves usability if the 63set of MAC policies may change over time. 64.Sh FILES 65.Bl -tag -width ".Pa /etc/mac.conf" -compact 66.It Pa /etc/mac.conf 67MAC library configuration file. 68.El 69.Sh EXAMPLES 70The following example configures user applications to operate with 71four MAC policies: 72.Xr mac_biba 4 , 73.Xr mac_mls 4 , 74SEBSD, 75and 76.Xr mac_partition 4 . 77.Bd -literal -offset indent 78# 79# Default label set to be used by simple MAC applications 80 81default_labels file ?biba,?lomac,?mls,?sebsd 82default_labels ifnet ?biba,?lomac,?mls,?sebsd 83default_labels process ?biba,?lomac,?mls,?partition,?sebsd 84default_labels socket ?biba,?lomac,?mls 85 86# 87# Deprecated (old) syntax 88 89default_file_labels ?biba,?mls,?sebsd 90default_ifnet_labels ?biba,?mls,?sebsd 91default_process_labels ?biba,?mls,partition,?sebsd 92.Ed 93.Pp 94In this example, userland applications will attempt to retrieve Biba, 95MLS, and SEBSD labels for all object classes; for processes, they will 96additionally attempt to retrieve a Partition identifier. 97In all cases except the Partition identifier, failure to retrieve a 98label due to the respective policy not being present will be ignored. 99.Sh SEE ALSO 100.Xr mac 3 , 101.Xr mac_get 3 , 102.Xr mac_prepare 3 , 103.Xr mac 4 , 104.Xr mac 9 105.Sh HISTORY 106Support for Mandatory Access Control was introduced in 107.Fx 5.0 108as part of the 109.Tn TrustedBSD 110Project. 111