1.\" Copyright (c) 2003 Networks Associates Technology, Inc. 2.\" All rights reserved. 3.\" 4.\" This software was developed for the FreeBSD Project by Chris Costello 5.\" at Safeport Network Services and Network Associates Labs, the 6.\" Security Research Division of Network Associates, Inc. under 7.\" DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the 8.\" DARPA CHATS research program. 9.\" 10.\" Redistribution and use in source and binary forms, with or without 11.\" modification, are permitted provided that the following conditions 12.\" are met: 13.\" 1. Redistributions of source code must retain the above copyright 14.\" notice, this list of conditions and the following disclaimer. 15.\" 2. Redistributions in binary form must reproduce the above copyright 16.\" notice, this list of conditions and the following disclaimer in the 17.\" documentation and/or other materials provided with the distribution. 18.\" 19.\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND 20.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE 23.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29.\" SUCH DAMAGE. 30.\" 31.\" $FreeBSD$ 32.Dd JANUARY 8, 2003 33.Os 34.Dt MAC 4 35.Sh NAME 36.Nm mac 37.Nd Mandatory Access Control 38.Sh SYNOPSIS 39.Cd "options MAC" 40.Sh DESCRIPTION 41.Ss Introduction 42The Mandatory Access Control, or MAC, framework allows administrators to 43finely control system security by providing for a loadable security policy 44architecture. 45It is important to note that due to its nature, MAC security policies may 46only further restrict security; they cannot override traditional UNIX 47security provisions such as file permissions and superuser checks. 48.Pp 49Currently, the following MAC policy modules are shipped with 50.Fx : 51.Bl -column ".Xr mac_seeotheruids 4" "low-watermark mac policy " ".Em Labeling" "boot only" 52.It Sy Name Ta Sy Description Ta Sy Labeling Ta Sy "Load time" 53.It Xr mac_biba 4 Ta "Biba integrity policy" Ta yes Ta boot only 54.It Xr mac_bsdextended 4 Ta "File system firewall" Ta no Ta any time 55.It Xr mac_ifoff 4 Ta "Interface silencing" Ta no Ta any time 56.It Xr mac_lomac 4 Ta "Low-Watermark MAC policy" Ta yes Ta boot only 57.It Xr mac_mls 4 Ta "Confidentiality policy" Ta yes Ta boot only 58.It Xr mac_none 4 Ta "Sample no-op policy" Ta no Ta any time 59.It Xr mac_partition 4 Ta "Process partition policy" Ta yes Ta any time 60.It Xr mac_seeotheruids 4 Ta "See-other-UIDs policy" Ta no Ta any time 61.It Xr mac_test 4 Ta "MAC testing policy" Ta no Ta any time 62.El 63.Ss MAC Labels 64Each system subject (processes, sockets, etc.) and each system object 65(file system objects, sockets, etc.) can carry with it a MAC label. 66MAC labels can contain data in an arbitrary format 67used by the MAC policies in order to help determine how to determine 68access rights for a given operation. 69Most MAC labels on system subjects and objects 70can be modified directly or indirectly by the system 71administrator. 72More information on the format for MAC labels can be found in the 73.Xr maclabel 7 74man page. 75.Ss Policy Enforcement 76MAC can be configured to enforce only specific portions of 77policies 78(see 79.Sx "Runtime Configuration" ) . 80Policy enforcement is divided into the following areas of the system: 81.Bl -ohang 82.It Sy File System 83File system mounts, modifying directories, modifying files, etc. 84.It Sy KLD 85Loading, unloading, and retrieving statistics on loaded kernel modules 86.It Sy Network 87Network interfaces, 88.Xr bpf 4 89.It Sy Pipes 90Creation of and operation on 91.Xr pipe 2 92objects 93.It Sy Processes 94Debugging 95(e.g. 96.Xr ktrace 2 ) , 97process visibility 98.Xr ( ps 1 ) , 99process execution 100.Xr ( execve 2 ) , 101signalling 102.Xr ( kill 2 ) 103.It Sy Sockets 104Creation and operation on 105.Xr socket 2 106objects 107.It Sy System 108Kernel environment 109.Xr ( kenv 1 ) , 110system accounting 111.Xr ( acct 2 ) , 112.Xr reboot 2 , 113.Xr settimeofday 2 , 114.Xr swapon 2 , 115.Xr sysctl 3 , 116.Sm off 117.Xr nfsd 8 - 118related 119.Sm on 120operations 121.It Sy VM 122.Sm off 123.Xr mmap 2 - 124ed 125.Sm on 126files 127.El 128.Ss Setting MAC Labels 129From the command line, each type of system object has its own means for setting 130and modifying its MAC policy label. 131.Bl -column "user (by login class)" "Xr login.conf 5" -offset indent 132.It Sy "Subject/Object" Ta Sy "Utility" 133.It "File system object" Ta Xr setfmac 8 134.It "Network interface" Ta Xr ifconfig 8 135.It "TTY (by login class)" Ta Xr login.conf 5 136.It "User (by login class)" Ta Xr login.conf 5 137.El 138.Pp 139Additionally, the 140.Xr setpmac 8 141command can be used to run a command with a different process label than 142the shell's current label. 143.Ss Programming With MAC 144MAC security enforcement itself is transparent to application 145programs, with the exception that some programs may need to be aware of 146additional 147.Xr errno 2 148returns from various system calls. 149.Pp 150The interface for retrieving, handling, and setting policy labels 151is documented in the 152.Xr mac 3 153man page. 154.Ss Runtime Configuration 155The following 156.Xr sysctl 8 157MIBs are available for fine-tuning the enforcement of MAC policies. 158Unless specifically noted, all MIBs default to 159.Li 1 160(that is, all areas are enforced by default): 161.Bl -tag -width "security.mac.mmap_revocation" 162.It Va security.mac.enforce_fs 163Enforce MAC policies for file system accesses 164.It Va security.mac.enforce_kld 165Enforce MAC policies on 166.Xr kld 4 167.It Va security.mac.enforce_network 168Enforce MAC policies on network interfaces 169.It Va security.mac.enforce_pipe 170Enforce MAC policies on pipes 171.It Va security.mac.enforce_process 172Enforce MAC policies between system processes 173(e.g. 174.Xr ps 1 , 175.Xr ktrace 2 ) 176.It Va security.mac.enforce_socket 177Enforce MAC policies on sockets 178.It Va security.mac.enforce_system 179Enforce MAC policies on system-related items 180(e.g. 181.Xr kenv 1 , 182.Xr acct 2 , 183.Xr reboot 2 ) 184.It Va security.mac.enforce_vm 185Enforce MAC policies on 186.Xr mmap 2 187and 188.Xr mprotect 2 189.It Va security.mac.mmap_revocation 190Revoke 191.Xr mmap 2 192access to files on subject relabel 193.It Va security.mac.mmap_revocation_via_cow 194Revoke 195.Xr mmap 2 196access to files via copy-on-write semantics; 197mapped regions will still appear writable, but will no longer 198effect a change on the underlying vnode 199(Default: 0) 200.El 201.Sh SEE ALSO 202.Xr mac 3 , 203.Xr mac_biba 4 , 204.Xr mac_bsdextended 4 , 205.Xr mac_ifoff 4 , 206.Xr mac_lomac 4 , 207.Xr mac_mls 4 , 208.Xr mac_none 4 , 209.Xr mac_partition 4 , 210.Xr mac_seeotheruids 4 , 211.Xr mac_test 4 , 212.Xr login.5 , 213.Xr maclabel 7 , 214.Xr getfmac 8 , 215.Xr setfmac 8 , 216.Xr getpmac 8 , 217.Xr setpmac 8 , 218.Xr mac 9 219.Rs 220.%B "The FreeBSD Handbook" 221.%T "Mandatory Access Control" 222.%O http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/mac.html 223.Re 224.Sh HISTORY 225The 226.Nm 227implementation first appeared in 228.Fx 5.0 229and was developed by the TrustedBSD Project. 230.Sh AUTHORS 231This software was contributed to the 232.Fx 233Project by Network Associates Labs, 234the Security Research Division of Network Associates 235Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), 236as part of the DARPA CHATS research program. 237