1.\" Copyright (c) 2002 Networks Associates Technology, Inc. 2.\" All rights reserved. 3.\" 4.\" This software was developed for the FreeBSD Project by Chris Costello 5.\" at Safeport Network Services and Network Associates Laboratories, the 6.\" Security Research Division of Network Associates, Inc. under 7.\" DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the 8.\" DARPA CHATS research program. 9.\" 10.\" Redistribution and use in source and binary forms, with or without 11.\" modification, are permitted provided that the following conditions 12.\" are met: 13.\" 1. Redistributions of source code must retain the above copyright 14.\" notice, this list of conditions and the following disclaimer. 15.\" 2. Redistributions in binary form must reproduce the above copyright 16.\" notice, this list of conditions and the following disclaimer in the 17.\" documentation and/or other materials provided with the distribution. 18.\" 19.\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND 20.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE 23.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29.\" SUCH DAMAGE. 30.\" 31.Dd July 25, 2015 32.Dt MAC_PARTITION 4 33.Os 34.Sh NAME 35.Nm mac_partition 36.Nd "process partition policy" 37.Sh SYNOPSIS 38To compile the process partition policy into your kernel, 39place the following lines in your kernel 40configuration file: 41.Bd -ragged -offset indent 42.Cd "options MAC" 43.Cd "options MAC_PARTITION" 44.Ed 45.Pp 46Alternately, to load the process partition module at boot time, 47place the following line in your kernel configuration file: 48.Bd -ragged -offset indent 49.Cd "options MAC" 50.Ed 51.Pp 52and in 53.Xr loader.conf 5 : 54.Bd -literal -offset indent 55mac_partition_load="YES" 56.Ed 57.Sh DESCRIPTION 58The 59.Nm 60policy module implements a process partition policy, 61which allows administrators to place running processes into 62.Dq partitions , 63based on their numeric process partition 64(specified in the process's MAC label). 65Processes with a specified partition can only see processes that are in the 66same partition. 67If no partition is specified for a process, it can see all other processes 68in the system 69(subject to other MAC policy restrictions not defined in this man page). 70No provisions for placing processes into multiple partitions are available. 71.Ss Label Format 72Partition labels take on the following format: 73.Pp 74.Sm off 75.Dl Li partition / Ar value 76.Sm on 77.Pp 78Where 79.Ar value 80can be any integer value or 81.Dq Li none . 82For example: 83.Bd -literal -offset indent 84partition/1 85partition/20 86partition/none 87.Ed 88.Sh SEE ALSO 89.Xr mac 4 , 90.Xr mac_biba 4 , 91.Xr mac_bsdextended 4 , 92.Xr mac_ddb 4 , 93.Xr mac_ifoff 4 , 94.Xr mac_lomac 4 , 95.Xr mac_mls 4 , 96.Xr mac_none 4 , 97.Xr mac_portacl 4 , 98.Xr mac_seeotheruids 4 , 99.Xr mac_test 4 , 100.Xr maclabel 7 , 101.Xr mac 9 102.Sh HISTORY 103The 104.Nm 105policy module first appeared in 106.Fx 5.0 107and was developed by the 108.Tn TrustedBSD 109Project. 110.Sh AUTHORS 111This software was contributed to the 112.Fx 113Project by Network Associates Labs, 114the Security Research Division of Network Associates 115Inc. 116under DARPA/SPAWAR contract N66001-01-C-8035 117.Pq Dq CBOSS , 118as part of the DARPA CHATS research program. 119.Sh BUGS 120While the MAC Framework design is intended to support the containment of 121the root user, not all attack channels are currently protected by entry 122point checks. 123As such, MAC Framework policies should not be relied on, in isolation, 124to protect against a malicious privileged user. 125