1.\" Copyright (c) 2002 Networks Associates Technology, Inc. 2.\" All rights reserved. 3.\" 4.\" This software was developed for the FreeBSD Project by Chris Costello 5.\" at Safeport Network Services and Network Associates Laboratories, the 6.\" Security Research Division of Network Associates, Inc. under 7.\" DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the 8.\" DARPA CHATS research program. 9.\" 10.\" Redistribution and use in source and binary forms, with or without 11.\" modification, are permitted provided that the following conditions 12.\" are met: 13.\" 1. Redistributions of source code must retain the above copyright 14.\" notice, this list of conditions and the following disclaimer. 15.\" 2. Redistributions in binary form must reproduce the above copyright 16.\" notice, this list of conditions and the following disclaimer in the 17.\" documentation and/or other materials provided with the distribution. 18.\" 19.\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND 20.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE 23.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29.\" SUCH DAMAGE. 30.\" 31.\" $FreeBSD$ 32.Dd NOVEMBER 18, 2002 33.Os 34.Dt MAC_BIBA 4 35.Sh NAME 36.Nm mac_biba 37.Nd Biba data integrity policy 38.Sh SYNOPSIS 39To compile Biba into your kernel, place the following lines in your kernel 40configuration file: 41.Cd "options MAC" 42.Cd "options MAC_BIBA" 43.Pp 44Alternately, to load the Biba module at boot time, place the following line 45in your kernel configuration file: 46.Cd "options MAC" 47.Pp 48and in 49.Xr loader.conf 5 : 50.Cd mac_biba_load= Ns \&"YES" 51.Sh DESCRIPTION 52The 53.Nm 54policy module implements the Biba integrity model, 55which protects the integrity of system objects and subjects by means of 56a strict information flow policy. 57In Biba, all system subjects and objects are assigned integrity labels, made 58up of hierarchal grades, and non-hierarchal components. 59Together, these label elements permit all labels to be placed in a partial 60order, with information flow protections based on a dominance operator 61describing the order. 62The hierarchal grade field is expressed as a value between 0 and 65535, 63with higher values reflecting higher integrity. 64The non-hierarchal compartment field is expressed as a set of up to 256 65components, numbered from 0 to 255. 66A complete label consists of both hierarchal and non-hierarchal elements. 67.Pp 68Three special label values exist: 69.Bl -column -offset indent "biba/equal" "lower than all other labels" 70.It Sy Label Ta Sy Comparison 71.It Li biba/low Ta lower than all other labels 72.It Li biba/equal Ta equal to all other labels 73.It Li biba/high Ta higher than all other labels 74.El 75.Pp 76The 77.Dq biba/high 78label is assigned to system objects which affect the integrity of the system 79as a whole. 80.Dq biba/equal 81may be used to indicate that a particular subject or object is exempt from 82the Biba protections. 83These special label values are not specified as containing any compartments, 84although in a label comparison, 85.Dq biba/high 86appears to contain all compartments, 87.Dq biba/equal 88the same compartments as the other label to which it is being compared, 89and 90.Dq biba/low 91none. 92.Pp 93In general, Biba access control takes the following model: 94.Bl -bullet 95.It 96A subject at the same integrity level as an object may both read from 97and write to the object as though Biba protections were not in place. 98.It 99A subject at a higher integrity level than an object may write to the object, 100but not read the object. 101.It 102A subject at a lower integrity level than an object may read the object, 103but not write to the object. 104.It 105If the subject and object labels may not be compared in the partial order, 106all access is restricted. 107.El 108.Pp 109These rules prevent subjects of lower integrity from influencing the 110behavior of higher integrity subjects by preventing the flow of information, 111and hence control, from allowing low integrity subjects to modify either 112a high integrity object or high integrity subjects acting on those objects. 113Biba integrity policies may be appropriate in a number of environments, 114both from the perspective of preventing corruption of the operating system, 115and corruption of user data if marked as higher integrity than the attacker. 116In traditional trusted operating systems, the Biba integrity model is used 117to protect the Trusted Code Base (TCB). 118.Pp 119The Biba integrity model is similar to 120.Xr lomac 4 , 121with the exception that LOMAC permits access by a higher integrity subject 122to a lower integrity object, but downgrades the integrity level of the subject 123to prevent integrity rules from being violated. 124Biba is a fixed label policy in that all subject and object label changes are 125explicit, whereas LOMAC is a floating label policy. 126.Pp 127The Biba integrity model is also similar to 128.Xr mac_mls 4 , 129with the exception that the dominance operator and access rules are reversed, 130preventing the downward flow of information rather than the upward flow of 131information. 132Multi-Level Security (MLS) protects the confidentiality, rather than the 133integrity, of subjects and objects. 134.Ss Label Format 135Almost all system objects are tagged with a single, active label element, 136reflecting the integrity of the object, or integrity of the data contained 137in the object. 138In general, objects labels are represented in the following form: 139.Pp 140.Dl biba/grade:compartments 141.Pp 142For example: 143.Pp 144.Bd -literal -offset indent 145biba/10:2+3+6 146biba/low 147.Ed 148.Pp 149Subject labels consist of three label elements: a single (active) label, 150as well as a range of available labels. 151This range is represented using two ordered Biba label elements, and when set 152on a process, permits the process to change its active label to any label of 153greater or equal integrity to the low end of the range, and lesser or equal 154integrity to the high end of the range. 155In general, subject labels are represented in the following form: 156.Pp 157.Dl biba/singlegrade:singlecompartments(lograde:locompartments- 158.Dl higrade:hicompartments) 159.Pp 160For example: 161.Bd -literal -offset indent 162biba/10:2+3+6(5:2+3-20:2+3+4+5+6) 163biba/high(low-high) 164.Ed 165.Pp 166Valid ranged labels must meet the following requirement regarding their 167elements: 168.Pp 169.Dl rangehigh >= single >= rangelow 170.Pp 171One class of objects with ranges currently exists, the network interface. 172In the case of the network interface, the single label element references the 173default label for packets received over the interface, and the range 174represents the range of acceptable labels of packets to be transmitted over 175the interface. 176.Ss Runtime Configuration 177The following 178.Xr sysctl 8 179MIBs are available for fine-tuning the enforcement of this MAC policy. 180.Bl -tag -width 'security.mac.biba.ptys_equal' 181.It Va security.mac.biba.enabled 182Enables enforcement of the Biba integrity policy 183(Default: 1) 184.It Va security.mac.biba.ptys_equal 185Label 186.Sm off 187.Xr pty 4 188s 189.Sm on 190as 191.Dq biba/equal 192upon creation 193(Default: 0) 194.It Va security.mac.biba.revocation_enabled 195Revoke access to objects if the label is changed to dominate the subject 196(Default: 0) 197.El 198.Sh SEE ALSO 199.Xr lomac 4 , 200.Xr mac 4 , 201.Xr mac_bsdextended 4 , 202.Xr mac_ifoff 4 , 203.Xr mac_lomac 4 , 204.Xr mac_mls 4 , 205.Xr mac_none 4 , 206.Xr mac_partition 4 , 207.Xr mac_seeotheruids 4 , 208.Xr mac_test 4 , 209.Xr maclabel 7 , 210.Xr mac 9 211.Sh HISTORY 212The 213.Nm 214policy module first appeared in 215.Fx 5.0 216and was developed by the TrustedBSD Project. 217.Sh AUTHORS 218This software was contributed to the 219.Fx 220Project by Network Associates Labs, 221the Security Research Division of Network Associates 222Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), 223as part of the DARPA CHATS research program. 224