1.\" Copyright (c) 2002 Networks Associates Technology, Inc. 2.\" All rights reserved. 3.\" 4.\" This software was developed for the FreeBSD Project by Chris Costello 5.\" at Safeport Network Services and Network Associates Laboratories, the 6.\" Security Research Division of Network Associates, Inc. under 7.\" DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the 8.\" DARPA CHATS research program. 9.\" 10.\" Redistribution and use in source and binary forms, with or without 11.\" modification, are permitted provided that the following conditions 12.\" are met: 13.\" 1. Redistributions of source code must retain the above copyright 14.\" notice, this list of conditions and the following disclaimer. 15.\" 2. Redistributions in binary form must reproduce the above copyright 16.\" notice, this list of conditions and the following disclaimer in the 17.\" documentation and/or other materials provided with the distribution. 18.\" 19.\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND 20.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE 23.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29.\" SUCH DAMAGE. 30.\" 31.\" $FreeBSD$ 32.\" 33.Dd December 11, 2002 34.Dt MAC_LOMAC 4 35.Os 36.Sh NAME 37.Nm mac_lomac 38.Nd "Low-watermark Mandatory Access Control data integrity policy" 39.Sh SYNOPSIS 40To compile LOMAC into your kernel, place the following lines in your kernel 41configuration file: 42.Bd -ragged -offset indent 43.Cd "options MAC" 44.Cd "options MAC_LOMAC" 45.Ed 46.Pp 47Alternately, to load the LOMAC module at boot time, place the following line 48in your kernel configuration file: 49.Bd -ragged -offset indent 50.Cd "options MAC" 51.Ed 52.Pp 53and in 54.Xr loader.conf 5 : 55.Bd -literal -offset indent 56mac_lomac_load="YES" 57.Ed 58.Sh DESCRIPTION 59The 60.Nm 61policy module implements the LOMAC integrity model, 62which protects the integrity of system objects and subjects by means of 63an information flow policy coupled with the subject demotion 64via floating labels. 65In LOMAC, all system subjects and objects are assigned integrity labels, made 66up of one or more hierarchial grades, depending on the their types. 67Together, these label elements permit all labels to be placed in a partial 68order, with information flow protections and demotion decisions 69based on a dominance operator 70describing the order. 71The hierarchal grade field or fields are expressed 72as a value between 0 and 65535, 73with higher values reflecting higher integrity. 74.Pp 75Three special label component values exist: 76.Bl -column -offset indent ".Sy Label" "dominated by all other labels" 77.It Sy Label Ta Sy Comparison 78.It Li low Ta "dominated by all other labels" 79.It Li equal Ta "equal to all other labels" 80.It Li high Ta "dominates all other labels" 81.El 82.Pp 83The 84.Dq Li high 85label is assigned to system objects which affect the integrity of the system 86as a whole. 87The 88.Dq Li equal 89label 90may be used to indicate that a particular subject or object is exempt from 91the LOMAC protections. 92For example, a label of 93.Dq Li lomac/equal(equal-equal) 94might be used on a subject which is to be used to administratively relabel 95anything on the system. 96.Pp 97Almost all system objects are tagged with a single, active label element, 98reflecting the integrity of the object, or integrity of the data contained 99in the object. 100File system objects may contain an additional auxiliary label which 101determines the inherited integrity level for new files created in a 102directory or the alternate label assumed by the subject upon execution of 103an executable. 104In general, objects labels are represented in the following form: 105.Pp 106.Sm off 107.D1 Li lomac / Ar grade Bq Ar auxgrade 108.Sm on 109.Pp 110For example: 111.Bd -literal -offset indent 112lomac/10[2] 113lomac/low 114.Ed 115.Pp 116Subject labels consist of three label elements: a single (active) label, 117as well as a range of available labels. 118This range is represented using two ordered LOMAC label elements, and when set 119on a process, permits the process to change its active label to any label of 120greater or equal integrity to the low end of the range, and lesser or equal 121integrity to the high end of the range. 122In general, subject labels are represented in the following form: 123.Pp 124.Sm off 125.D1 Li lomac / Ar singlegrade ( lograde No - Ar higrade ) 126.Sm on 127.Pp 128Modification of objects is restricted to access via the following comparison: 129.Pp 130.D1 Ar subject Ns :: Ns Ar higrade No \[>=] Ar target-object Ns :: Ns Ar grade 131.Pp 132Modification of subjects is the same, as the target subject's single grade 133is the only element taken into comparison. 134.Pp 135Demotion of a subject occurs when the following comparison is true: 136.Pp 137.D1 Ar subject Ns :: Ns Ar singlegrade No > Ar object Ns :: Ns Ar grade 138.Pp 139When demotion occurs, the subject's 140.Ar singlegrade 141and 142.Ar higrade 143are reduced to the 144object's grade, as well as the 145.Ar lograde 146if necessary. 147When the demotion occurs, in addition to the permission of the subject being 148reduced, shared 149.Xr mmap 2 150objects which it has opened in its memory space may be revoked according to 151the following 152.Xr sysctl 3 153variables: 154.Pp 155.Bl -bullet -compact 156.It 157.Va security.mac.lomac.revocation_enabled 158.It 159.Va security.mac.enforce_vm 160.It 161.Va security.mac.mmap_revocation 162.It 163.Va security.mac.mmap_revocation_via_cow 164.El 165.Pp 166Upon execution of a file, if the executable has an auxiliary label, and that 167label is within the current range of 168.Ar lograde Ns - Ns Ar higrade , 169it will be assumed by the subject immediately. 170After this, demotion is performed just as with any other read operation, with 171the executable as the target. 172Through the use of auxiliary labels, programs may be initially executed 173at a lower effective integrity level, 174while retaining the ability to raise it again. 175.Pp 176These rules prevent subjects of lower integrity from influencing the 177behavior of higher integrity subjects by preventing the flow of information, 178and hence control, from allowing low integrity subjects to modify either 179a high integrity object or high integrity subjects acting on those objects. 180LOMAC integrity policies may be appropriate in a number of environments, 181both from the perspective of preventing corruption of the operating system, 182and corruption of user data if marked as higher integrity than the attacker. 183.Pp 184The LOMAC security model is quite similar to that of 185.Xr mac_biba 4 186and 187.Xr mac_mls 4 188in various ways. 189More background information on this can be found in their respective 190man pages. 191.Sh SEE ALSO 192.Xr mmap 2 , 193.Xr sysctl 3 , 194.Xr mac 4 , 195.Xr mac_biba 4 , 196.Xr mac_bsdextended 4 , 197.Xr mac_ifoff 4 , 198.Xr mac_mls 4 , 199.Xr mac_none 4 , 200.Xr mac_partition 4 , 201.Xr mac_portacl 4 , 202.Xr mac_seeotheruids 4 , 203.Xr mac_test 4 , 204.Xr mac 9 205.Sh HISTORY 206The 207.Nm 208policy module first appeared in 209.Fx 5.0 210and was developed by the 211.Tn TrustedBSD 212Project. 213.Sh AUTHORS 214This software was contributed to the 215.Fx 216Project by Network Associates Labs, 217the Security Research Division of Network Associates 218Inc. 219under DARPA/SPAWAR contract N66001-01-C-8035 220.Pq Dq CBOSS , 221as part of the DARPA CHATS research program. 222