1.\" Copyright (c) 2002 Networks Associates Technology, Inc. 2.\" All rights reserved. 3.\" 4.\" This software was developed for the FreeBSD Project by Chris Costello 5.\" at Safeport Network Services and Network Associates Laboratories, the 6.\" Security Research Division of Network Associates, Inc. under 7.\" DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the 8.\" DARPA CHATS research program. 9.\" 10.\" Redistribution and use in source and binary forms, with or without 11.\" modification, are permitted provided that the following conditions 12.\" are met: 13.\" 1. Redistributions of source code must retain the above copyright 14.\" notice, this list of conditions and the following disclaimer. 15.\" 2. Redistributions in binary form must reproduce the above copyright 16.\" notice, this list of conditions and the following disclaimer in the 17.\" documentation and/or other materials provided with the distribution. 18.\" 19.\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND 20.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE 23.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29.\" SUCH DAMAGE. 30.\" 31.\" $FreeBSD$ 32.Dd December 11, 2002 33.Os 34.Dt MAC_LOMAC 4 35.Sh NAME 36.Nm mac_lomac 37.Nd Low-watermark Mandatory Access Control data integrity policy 38.Sh SYNOPSIS 39To compile LOMAC into your kernel, place the following lines in your kernel 40configuration file: 41.Cd "options MAC" 42.Cd "options MAC_LOMAC" 43.Pp 44Alternately, to load the LOMAC module at boot time, place the following line 45in your kernel configuration file: 46.Cd "options MAC" 47.Pp 48and in 49.Xr loader.conf 5 : 50.Cd mac_lomac_load= Ns \&"YES" 51.Sh DESCRIPTION 52The 53.Nm 54policy module implements the LOMAC integrity model, 55which protects the integrity of system objects and subjects by means of 56an information flow policy coupled with the subject demotion 57via floating labels. 58In LOMAC, all system subjects and objects are assigned integrity labels, made 59up of one or more hierarchal grades, depending on the their types. 60Together, these label elements permit all labels to be placed in a partial 61order, with information flow protections and demotion decisions 62based on a dominance operator 63describing the order. 64The hierarchal grade field or fields are expressed 65as a value between 0 and 65535, 66with higher values reflecting higher integrity. 67.Pp 68Three special label component values exist: 69.Bl -column -offset indent ".Sy Label" "dominated by all other labels" 70.It Sy Label Ta Sy Comparison 71.It Li low Ta dominated by all other labels 72.It Li equal Ta equal to all other labels 73.It Li high Ta dominates all other labels 74.El 75.Pp 76The 77.Dq high 78label is assigned to system objects which affect the integrity of the system 79as a whole. 80.Dq equal 81may be used to indicate that a particular subject or object is exempt from 82the LOMAC protections. 83For example, a label of 84.Dq lomac/equal(equal-equal) 85might be used on a subject which is to be used to administratively relabel 86anything on the system. 87.Pp 88Almost all system objects are tagged with a single, active label element, 89reflecting the integrity of the object, or integrity of the data contained 90in the object. 91Filesystem objects may contain an additional auxiliary label which 92determines the inherited integrity level for new files created in a 93directory or the alternate label assumed by the subject upon execution of 94an executable. 95In general, objects labels are represented in the following form: 96.Pp 97.Dl lomac/ Ns Sy grade Ns [ Sy auxgrade ] 98.Pp 99For example: 100.Pp 101.Bd -literal -offset indent 102lomac/10[2] 103lomac/low 104.Ed 105.Pp 106Subject labels consist of three label elements: a single (active) label, 107as well as a range of available labels. 108This range is represented using two ordered LOMAC label elements, and when set 109on a process, permits the process to change its active label to any label of 110greater or equal integrity to the low end of the range, and lesser or equal 111integrity to the high end of the range. 112In general, subject labels are represented in the following form: 113.Pp 114.Dl lomac/ Ns Sy singlegrade Ns ( Sy lograde Ns - Ns Sy higrade ) 115.Pp 116Modification of objects is restricted to access via the following comparison: 117.Pp 118.Dl subject::higrade >= target-object::grade 119.Pp 120Modification of subjects is the same, as the target subject's single grade 121is the only element taken into comparison. 122.Pp 123Demotion of a subject occurs when the following comparison is true: 124.Pp 125.Dl subject::singlegrade > object::grade 126.Pp 127When demotion occurs, the subject's singlegrade and higrade are reduced to the 128object's grade, as well as the lograde if necessary. 129When the demotion occurs, in addition to the permission of the subject being 130reduced, shared 131.Xr mmap 2 132objects which it has opened in its memory space may be revoked according to 133the following 134.Xr sysctl 2 135variables: 136.Bl -bullet 137.It 138.Va security.mac.lomac.revocation_enabled 139.It 140.Va security.mac.enforce_vm 141.It 142.Va security.mac.mmap_revocation 143.It 144.Va security.mac.mmap_revocation_via_cow 145.El 146.Pp 147Upon execution of a file, if the executable has an auxiliary label, and that 148label is within the current range of 149.Sy lograde-higrade , 150it will be assumed by the subject immediately. 151After this, demotion is performed just as with any other read operation, with 152the executable as the target. 153Through the use of auxiliary labels, programs may be initially executed 154at a lower effective integrity level, 155while retaining the ability to raise it again. 156.Pp 157These rules prevent subjects of lower integrity from influencing the 158behavior of higher integrity subjects by preventing the flow of information, 159and hence control, from allowing low integrity subjects to modify either 160a high integrity object or high integrity subjects acting on those objects. 161LOMAC integrity policies may be appropriate in a number of environments, 162both from the perspective of preventing corruption of the operating system, 163and corruption of user data if marked as higher integrity than the attacker. 164.Pp 165The LOMAC security model is quite similar to that of 166.Xr mac_biba 4 167and 168.Xr mac_mls 4 169in various ways. 170More background information on this can be found in their respective 171man pages. 172.Sh SEE ALSO 173.Xr mmap 2 , 174.Xr sysctl 2 , 175.Xr mac 4 , 176.Xr mac_biba 4 , 177.Xr mac_bsdextended 4 , 178.Xr mac_ifoff 4 , 179.Xr mac_mls 4 , 180.Xr mac_none 4 , 181.Xr mac_partition 4 , 182.Xr mac_seeotheruids 4 , 183.Xr mac_test 4 , 184.Xr mac 9 185.Sh HISTORY 186The 187.Nm 188policy module first appeared in 189.Fx 5.0 190and was developed by the TrustedBSD Project. 191.Sh AUTHORS 192This software was contributed to the 193.Fx 194Project by Network Associates Labs, 195the Security Research Division of Network Associates 196Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), 197as part of the DARPA CHATS research program. 198