1.\" Copyright (c) 2003 Networks Associates Technology, Inc. 2.\" All rights reserved. 3.\" 4.\" This software was developed for the FreeBSD Project in part by Network 5.\" Associates Laboratories, the Security Research Division of Network 6.\" Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), 7.\" as part of the DARPA CHATS research program. 8.\" 9.\" Redistribution and use in source and binary forms, with or without 10.\" modification, are permitted provided that the following conditions 11.\" are met: 12.\" 1. Redistributions of source code must retain the above copyright 13.\" notice, this list of conditions and the following disclaimer. 14.\" 2. Redistributions in binary form must reproduce the above copyright 15.\" notice, this list of conditions and the following disclaimer in the 16.\" documentation and/or other materials provided with the distribution. 17.\" 18.\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND 19.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 20.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 21.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE 22.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 23.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 24.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 25.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 26.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 27.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 28.\" SUCH DAMAGE. 29.\" 30.\" $FreeBSD$ 31.\" 32.Dd April 19, 2003 33.Dt MAC.CONF 5 34.Os 35.Sh NAME 36.Nm mac.conf 37.Nd format of the MAC library configuration file 38.Sh DESCRIPTION 39The 40.Nm 41file configures the default label elements to be used by policy-agnostic 42applications that operate on MAC labels. 43A file contains a series of default label sets specified by object class, 44in addition to blank lines and comments preceded by a 45.Ql # 46symbol. 47.Pp 48Each declaration consists of a single line with two fields separated 49by white space: the object class name, and a list of label elements 50as used by the 51.Xr mac_prepare 3 52library calls prior to an application invocation of a function from 53.Xr mac_get 3 . 54Label element names may optionally begin with a 55.Ql \&? 56symbol to indicate that a failure to retrieve the label element for 57an object should be silently ignored, and improves usability if the 58set of MAC policies may change over time. 59.Sh EXAMPLES 60The following example configures user applications to operate with 61four MAC policies: 62.Xr mac_biba 4 , 63.Xr mac_mls 4 , 64SEBSD, 65and 66.Xr mac_partition 4 . 67.Bd -literal -offset indent 68# 69# Default label set to be used by simple MAC applications 70# 71 72default_file_labels ?biba,?mls,?sebsd 73default_ifnet_labels ?biba,?mls,?sebsd 74default_process_labels ?biba,?mls,partition,?sebsd 75.Ed 76.Pp 77In this example, userland applications will attempt to retrieve Biba, 78MLS, and SEBSD labels for all object classes; for processes, they will 79additionally attempt to retrieve a Partition identifier. 80In all cases except the Partition identifier, failure to retrieve a 81label due to the respective policy not being present will be ignored. 82.Sh FILES 83.Bl -tag -width ".Pa /etc/mac.conf" -compact 84.It Pa /etc/mac.conf 85MAC library configuration file. 86.El 87.Sh SEE ALSO 88.Xr mac 3 , 89.Xr mac_get 3 , 90.Xr mac_prepare 3 , 91.Xr mac 4 , 92.Xr mac 9 93.Sh HISTORY 94Support for Mandatory Access Control was introduced in 95.Fx 5.0 96as part of the 97.Tn TrustedBSD 98Project. 99.Sh BUGS 100The 101.Tn TrustedBSD 102MAC Framework and associated policies, interfaces, and 103applications are considered to be an experimental feature in 104.Fx . 105Sites considering production deployment should keep the experimental 106status of these services in mind during any deployment process. 107See also 108.Xr mac 9 109for related considerations regarding the kernel framework. 110