1.\" Copyright (c) 2002 Networks Associates Technology, Inc. 2.\" All rights reserved. 3.\" 4.\" This software was developed for the FreeBSD Project by Chris Costello 5.\" at Safeport Network Services and Network Associates Laboratories, the 6.\" Security Research Division of Network Associates, Inc. under 7.\" DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the 8.\" DARPA CHATS research program. 9.\" 10.\" Redistribution and use in source and binary forms, with or without 11.\" modification, are permitted provided that the following conditions 12.\" are met: 13.\" 1. Redistributions of source code must retain the above copyright 14.\" notice, this list of conditions and the following disclaimer. 15.\" 2. Redistributions in binary form must reproduce the above copyright 16.\" notice, this list of conditions and the following disclaimer in the 17.\" documentation and/or other materials provided with the distribution. 18.\" 19.\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND 20.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE 23.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29.\" SUCH DAMAGE. 30.\" 31.\" $FreeBSD$ 32.Dd DECEMBER 9, 2002 33.Os 34.Dt MAC_PARTITION 4 35.Sh NAME 36.Nm mac_partition 37.Nd process partition policy 38.Sh SYNOPSIS 39To compile the process partition policy into your kernel, 40place the following lines in your kernel 41configuration file: 42.Cd "options MAC" 43.Cd "options MAC_PARTITION" 44.Pp 45Alternately, to load the process partition module at boot time, 46place the following line in your kernel configuration file: 47.Cd "options MAC" 48.Pp 49and in 50.Xr loader.conf 5 : 51.Cd mac_partition_load= Ns \&"YES" 52.Sh DESCRIPTION 53The 54.Nm 55policy module implements a process partition policy, 56which allows administrators to place running processes into 57.Dq partitions, 58based on their numeric process partition 59(specified in the process's MAC label). 60Processes with a specified partition can only see processes that are in the 61same partition. 62If no partition is specified for a process, it can see all other processes 63in the system 64(subject to other MAC policy restrictions not defined in this man page). 65No provisions for placing processes into multiple partitions is available. 66.Ss Label Format 67Partition labels take on the following format: 68.Pp 69.Dl partition/ Ns Sy value 70.Pp 71Where 72.Sy value 73can be any integer value or 74.Dq none . 75For example: 76.Pp 77.Bd -literal -offset indent 78partition/1 79partition/20 80partition/none 81.Ed 82.Sh SEE ALSO 83.Xr lomac 4 , 84.Xr mac 4 , 85.Xr mac_biba 4 , 86.Xr mac_bsdextended 4 , 87.Xr mac_ifoff 4 , 88.Xr mac_lomac 4 , 89.Xr mac_mls 4 , 90.Xr mac_none 4 , 91.Xr mac_seeotheruids 4 , 92.Xr mac_test 4 , 93.Xr maclabel 7 , 94.Xr mac 9 95.Sh HISTORY 96The 97.Nm 98policy module first appeared in 99.Fx 5.0 100and was developed by the TrustedBSD Project. 101.Sh AUTHORS 102This software was contributed to the 103.Fx 104Project by Network Associates Labs, 105the Security Research Division of Network Associates 106Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), 107as part of the DARPA CHATS research program. 108.Sh BUGS 109See 110.Xr mac 9 111concerning appropriateness for production use. 112The TrustedBSD MAC Framework is considered experimental in 113.Fx . 114.Pp 115While the MAC Framework design is intended to support the containment of 116the root user, not all attack channels are currently protected by entry 117point checks. 118As such, MAC Framework policies should not be relied on, in isolation, 119to protect against a malicious privileged user. 120