1.\" Copyright (c) 2002 Networks Associates Technology, Inc. 2.\" All rights reserved. 3.\" 4.\" This software was developed for the FreeBSD Project by Chris Costello 5.\" at Safeport Network Services and Network Associates Laboratories, the 6.\" Security Research Division of Network Associates, Inc. under 7.\" DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the 8.\" DARPA CHATS research program. 9.\" 10.\" Redistribution and use in source and binary forms, with or without 11.\" modification, are permitted provided that the following conditions 12.\" are met: 13.\" 1. Redistributions of source code must retain the above copyright 14.\" notice, this list of conditions and the following disclaimer. 15.\" 2. Redistributions in binary form must reproduce the above copyright 16.\" notice, this list of conditions and the following disclaimer in the 17.\" documentation and/or other materials provided with the distribution. 18.\" 19.\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND 20.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE 23.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29.\" SUCH DAMAGE. 30.\" 31.Dd February 25, 2012 32.Dt MAC_LOMAC 4 33.Os 34.Sh NAME 35.Nm mac_lomac 36.Nd "Low-watermark Mandatory Access Control data integrity policy" 37.Sh SYNOPSIS 38To compile LOMAC into your kernel, place the following lines in your kernel 39configuration file: 40.Bd -ragged -offset indent 41.Cd "options MAC" 42.Cd "options MAC_LOMAC" 43.Ed 44.Pp 45Alternately, to load the LOMAC module at boot time, place the following line 46in your kernel configuration file: 47.Bd -ragged -offset indent 48.Cd "options MAC" 49.Ed 50.Pp 51and in 52.Xr loader.conf 5 : 53.Bd -literal -offset indent 54mac_lomac_load="YES" 55.Ed 56.Sh DESCRIPTION 57The 58.Nm 59policy module implements the LOMAC integrity model, 60which protects the integrity of system objects and subjects by means of 61an information flow policy coupled with the subject demotion 62via floating labels. 63In LOMAC, all system subjects and objects are assigned integrity labels, made 64up of one or more hierarchical grades, depending on their types. 65Together, these label elements permit all labels to be placed in a partial 66order, with information flow protections and demotion decisions 67based on a dominance operator 68describing the order. 69The hierarchal grade field or fields are expressed 70as a value between 0 and 65535, 71with higher values reflecting higher integrity. 72.Pp 73Three special label component values exist: 74.Bl -column -offset indent ".Sy Label" "dominated by all other labels" 75.It Sy Label Ta Sy Comparison 76.It Li low Ta "dominated by all other labels" 77.It Li equal Ta "equal to all other labels" 78.It Li high Ta "dominates all other labels" 79.El 80.Pp 81The 82.Dq Li high 83label is assigned to system objects which affect the integrity of the system 84as a whole. 85The 86.Dq Li equal 87label 88may be used to indicate that a particular subject or object is exempt from 89the LOMAC protections. 90For example, a label of 91.Dq Li lomac/equal(equal-equal) 92might be used on a subject which is to be used to administratively relabel 93anything on the system. 94.Pp 95Almost all system objects are tagged with a single, active label element, 96reflecting the integrity of the object, or integrity of the data contained 97in the object. 98File system objects may contain an additional auxiliary label which 99determines the inherited integrity level for new files created in a 100directory or the alternate label assumed by the subject upon execution of 101an executable. 102In general, objects labels are represented in the following form: 103.Pp 104.Sm off 105.D1 Li lomac / Ar grade Bq Ar auxgrade 106.Sm on 107.Pp 108For example: 109.Bd -literal -offset indent 110lomac/10[2] 111lomac/low 112.Ed 113.Pp 114Subject labels consist of three label elements: a single (active) label, 115as well as a range of available labels. 116This range is represented using two ordered LOMAC label elements, and when set 117on a process, permits the process to change its active label to any label of 118greater or equal integrity to the low end of the range, and lesser or equal 119integrity to the high end of the range. 120In general, subject labels are represented in the following form: 121.Pp 122.Sm off 123.D1 Li lomac / Ar singlegrade ( lograde No - Ar higrade ) 124.Sm on 125.Pp 126Modification of objects is restricted to access via the following comparison: 127.Pp 128.D1 Ar subject Ns :: Ns Ar higrade No \[>=] Ar target-object Ns :: Ns Ar grade 129.Pp 130Modification of subjects is the same, as the target subject's single grade 131is the only element taken into comparison. 132.Pp 133Demotion of a subject occurs when the following comparison is true: 134.Pp 135.D1 Ar subject Ns :: Ns Ar singlegrade No > Ar object Ns :: Ns Ar grade 136.Pp 137When demotion occurs, the subject's 138.Ar singlegrade 139and 140.Ar higrade 141are reduced to the 142object's grade, as well as the 143.Ar lograde 144if necessary. 145When the demotion occurs, in addition to the permission of the subject being 146reduced, shared 147.Xr mmap 2 148objects which it has opened in its memory space may be revoked according to 149the following 150.Xr sysctl 3 151variables: 152.Pp 153.Bl -bullet -compact 154.It 155.Va security.mac.lomac.revocation_enabled 156.It 157.Va security.mac.enforce_vm 158.It 159.Va security.mac.mmap_revocation 160.It 161.Va security.mac.mmap_revocation_via_cow 162.El 163.Pp 164Upon execution of a file, if the executable has an auxiliary label, and that 165label is within the current range of 166.Ar lograde Ns - Ns Ar higrade , 167it will be assumed by the subject immediately. 168After this, demotion is performed just as with any other read operation, with 169the executable as the target. 170Through the use of auxiliary labels, programs may be initially executed 171at a lower effective integrity level, 172while retaining the ability to raise it again. 173.Pp 174These rules prevent subjects of lower integrity from influencing the 175behavior of higher integrity subjects by preventing the flow of information, 176and hence control, from allowing low integrity subjects to modify either 177a high integrity object or high integrity subjects acting on those objects. 178LOMAC integrity policies may be appropriate in a number of environments, 179both from the perspective of preventing corruption of the operating system, 180and corruption of user data if marked as higher integrity than the attacker. 181.Pp 182The LOMAC security model is quite similar to that of 183.Xr mac_biba 4 184and 185.Xr mac_mls 4 186in various ways. 187More background information on this can be found in their respective 188man pages. 189.Sh SEE ALSO 190.Xr mmap 2 , 191.Xr sysctl 3 , 192.Xr mac 4 , 193.Xr mac_biba 4 , 194.Xr mac_bsdextended 4 , 195.Xr mac_ddb 4 , 196.Xr mac_ifoff 4 , 197.Xr mac_mls 4 , 198.Xr mac_none 4 , 199.Xr mac_partition 4 , 200.Xr mac_portacl 4 , 201.Xr mac_seeotheruids 4 , 202.Xr mac_test 4 , 203.Xr mac 9 204.Sh HISTORY 205The 206.Nm 207policy module first appeared in 208.Fx 5.0 209and was developed by the 210.Tn TrustedBSD 211Project. 212.Sh AUTHORS 213This software was contributed to the 214.Fx 215Project by Network Associates Labs, 216the Security Research Division of Network Associates 217Inc. 218under DARPA/SPAWAR contract N66001-01-C-8035 219.Pq Dq CBOSS , 220as part of the DARPA CHATS research program. 221