1.\" Copyright (c) 2002-2004 Networks Associates Technology, Inc. 2.\" All rights reserved. 3.\" 4.\" This software was developed for the FreeBSD Project by Chris Costello 5.\" at Safeport Network Services and Network Associates Laboratories, the 6.\" Security Research Division of Network Associates, Inc. under 7.\" DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the 8.\" DARPA CHATS research program. 9.\" 10.\" Redistribution and use in source and binary forms, with or without 11.\" modification, are permitted provided that the following conditions 12.\" are met: 13.\" 1. Redistributions of source code must retain the above copyright 14.\" notice, this list of conditions and the following disclaimer. 15.\" 2. Redistributions in binary form must reproduce the above copyright 16.\" notice, this list of conditions and the following disclaimer in the 17.\" documentation and/or other materials provided with the distribution. 18.\" 19.\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND 20.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE 23.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29.\" SUCH DAMAGE. 30.\" 31.\" $FreeBSD$ 32.\" 33.Dd November 18, 2002 34.Dt MAC_BIBA 4 35.Os 36.Sh NAME 37.Nm mac_biba 38.Nd "Biba data integrity policy" 39.Sh SYNOPSIS 40To compile Biba into your kernel, place the following lines in your kernel 41configuration file: 42.Bd -ragged -offset indent 43.Cd "options MAC" 44.Cd "options MAC_BIBA" 45.Ed 46.Pp 47Alternately, to load the Biba module at boot time, place the following line 48in your kernel configuration file: 49.Bd -ragged -offset indent 50.Cd "options MAC" 51.Ed 52.Pp 53and in 54.Xr loader.conf 5 : 55.Bd -literal -offset indent 56mac_biba_load="YES" 57.Ed 58.Sh DESCRIPTION 59The 60.Nm 61policy module implements the Biba integrity model, 62which protects the integrity of system objects and subjects by means of 63a strict information flow policy. 64In Biba, all system subjects and objects are assigned integrity labels, made 65up of hierarchal grades, and non-hierarchal components. 66Together, these label elements permit all labels to be placed in a partial 67order, with information flow protections based on a dominance operator 68describing the order. 69The hierarchal grade field is expressed as a value between 0 and 65535, 70with higher values reflecting higher integrity. 71The non-hierarchal compartment field is expressed as a set of up to 256 72components, numbered from 0 to 255. 73A complete label consists of both hierarchal and non-hierarchal elements. 74.Pp 75Three special label values exist: 76.Bl -column -offset indent ".Li biba/equal" "lower than all other labels" 77.It Sy Label Ta Sy Comparison 78.It Li biba/low Ta "lower than all other labels" 79.It Li biba/equal Ta "equal to all other labels" 80.It Li biba/high Ta "higher than all other labels" 81.El 82.Pp 83The 84.Dq Li biba/high 85label is assigned to system objects which affect the integrity of the system 86as a whole. 87The 88.Dq Li biba/equal 89label 90may be used to indicate that a particular subject or object is exempt from 91the Biba protections. 92These special label values are not specified as containing any compartments, 93although in a label comparison, 94.Dq Li biba/high 95appears to contain all compartments, 96.Dq Li biba/equal 97the same compartments as the other label to which it is being compared, 98and 99.Dq Li biba/low 100none. 101.Pp 102In general, Biba access control takes the following model: 103.Bl -bullet 104.It 105A subject at the same integrity level as an object may both read from 106and write to the object as though Biba protections were not in place. 107.It 108A subject at a higher integrity level than an object may write to the object, 109but not read the object. 110.It 111A subject at a lower integrity level than an object may read the object, 112but not write to the object. 113.It 114If the subject and object labels may not be compared in the partial order, 115all access is restricted. 116.El 117.Pp 118These rules prevent subjects of lower integrity from influencing the 119behavior of higher integrity subjects by preventing the flow of information, 120and hence control, from allowing low integrity subjects to modify either 121a high integrity object or high integrity subjects acting on those objects. 122Biba integrity policies may be appropriate in a number of environments, 123both from the perspective of preventing corruption of the operating system, 124and corruption of user data if marked as higher integrity than the attacker. 125In traditional trusted operating systems, the Biba integrity model is used 126to protect the Trusted Code Base (TCB). 127.Pp 128The Biba integrity model is similar to 129.Xr mac_lomac 4 , 130with the exception that LOMAC permits access by a higher integrity subject 131to a lower integrity object, but downgrades the integrity level of the subject 132to prevent integrity rules from being violated. 133Biba is a fixed label policy in that all subject and object label changes are 134explicit, whereas LOMAC is a floating label policy. 135.Pp 136The Biba integrity model is also similar to 137.Xr mac_mls 4 , 138with the exception that the dominance operator and access rules are reversed, 139preventing the downward flow of information rather than the upward flow of 140information. 141Multi-Level Security (MLS) protects the confidentiality, rather than the 142integrity, of subjects and objects. 143.Ss Label Format 144Almost all system objects are tagged with an effective, active label element, 145reflecting the integrity of the object, or integrity of the data contained 146in the object. 147In general, objects labels are represented in the following form: 148.Pp 149.Sm off 150.D1 Li biba / Ar grade : compartments 151.Sm on 152.Pp 153For example: 154.Bd -literal -offset indent 155biba/10:2+3+6 156biba/low 157.Ed 158.Pp 159Subject labels consist of three label elements: an effective (active) label, 160as well as a range of available labels. 161This range is represented using two ordered Biba label elements, and when set 162on a process, permits the process to change its active label to any label of 163greater or equal integrity to the low end of the range, and lesser or equal 164integrity to the high end of the range. 165In general, subject labels are represented in the following form: 166.Pp 167.Sm off 168.D1 Li biba / Ar effectivegrade : effectivecompartments ( lograde : locompartments - 169.D1 Ar higrade : hicompartments ) 170.Sm on 171.Pp 172For example: 173.Bd -literal -offset indent 174biba/10:2+3+6(5:2+3-20:2+3+4+5+6) 175biba/high(low-high) 176.Ed 177.Pp 178Valid ranged labels must meet the following requirement regarding their 179elements: 180.Pp 181.D1 Ar rangehigh No \[>=] Ar effective No \[>=] Ar rangelow 182.Pp 183One class of objects with ranges currently exists, the network interface. 184In the case of the network interface, the effective label element references the 185default label for packets received over the interface, and the range 186represents the range of acceptable labels of packets to be transmitted over 187the interface. 188.Ss Runtime Configuration 189The following 190.Xr sysctl 8 191MIBs are available for fine-tuning the enforcement of this MAC policy. 192.Bl -tag -width ".Va security.mac.biba.ptys_equal" 193.It Va security.mac.biba.enabled 194Enables enforcement of the Biba integrity policy. 195(Default: 1). 196.It Va security.mac.biba.ptys_equal 197Label 198.Xr pty 4 Ns s 199as 200.Dq Li biba/equal 201upon creation. 202(Default: 0). 203.It Va security.mac.biba.revocation_enabled 204Revoke access to objects if the label is changed to dominate the subject. 205(Default: 0). 206.El 207.Sh SEE ALSO 208.Xr mac 4 , 209.Xr mac_bsdextended 4 , 210.Xr mac_ifoff 4 , 211.Xr mac_lomac 4 , 212.Xr mac_mls 4 , 213.Xr mac_none 4 , 214.Xr mac_partition 4 , 215.Xr mac_portacl 4 , 216.Xr mac_seeotheruids 4 , 217.Xr mac_test 4 , 218.Xr maclabel 7 , 219.Xr mac 9 220.Sh HISTORY 221The 222.Nm 223policy module first appeared in 224.Fx 5.0 225and was developed by the 226.Tn TrustedBSD 227Project. 228.Sh AUTHORS 229This software was contributed to the 230.Fx 231Project by Network Associates Labs, 232the Security Research Division of Network Associates 233Inc. 234under DARPA/SPAWAR contract N66001-01-C-8035 235.Pq Dq CBOSS , 236as part of the DARPA CHATS research program. 237