xref: /freebsd/share/man/man4/mac_stub.4 (revision 50d922a02e3e29501689308a8c842e27f078faf3)
1b8be9d15SRobert Watson.\" Copyright (c) 2002, 2003 Networks Associates Technology, Inc.
217c5113aSChris Costello.\" All rights reserved.
317c5113aSChris Costello.\"
45792da74SChris Costello.\" This software was developed for the FreeBSD Project by Chris Costello
55792da74SChris Costello.\" at Safeport Network Services and Network Associates Laboratories, the
65792da74SChris Costello.\" Security Research Division of Network Associates, Inc. under
717c5113aSChris Costello.\" DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the
817c5113aSChris Costello.\" DARPA CHATS research program.
917c5113aSChris Costello.\"
1017c5113aSChris Costello.\" Redistribution and use in source and binary forms, with or without
1117c5113aSChris Costello.\" modification, are permitted provided that the following conditions
1217c5113aSChris Costello.\" are met:
1317c5113aSChris Costello.\" 1. Redistributions of source code must retain the above copyright
1417c5113aSChris Costello.\"    notice, this list of conditions and the following disclaimer.
1517c5113aSChris Costello.\" 2. Redistributions in binary form must reproduce the above copyright
1617c5113aSChris Costello.\"    notice, this list of conditions and the following disclaimer in the
1717c5113aSChris Costello.\"    documentation and/or other materials provided with the distribution.
1817c5113aSChris Costello.\"
1917c5113aSChris Costello.\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
2017c5113aSChris Costello.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
2117c5113aSChris Costello.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
2217c5113aSChris Costello.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
2317c5113aSChris Costello.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
2417c5113aSChris Costello.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
2517c5113aSChris Costello.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
2617c5113aSChris Costello.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
2717c5113aSChris Costello.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
2817c5113aSChris Costello.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
2917c5113aSChris Costello.\" SUCH DAMAGE.
3017c5113aSChris Costello.\"
3117c5113aSChris Costello.\" $FreeBSD$
323cc3bf52SRuslan Ermilov.\"
333cc3bf52SRuslan Ermilov.Dd December 1, 2002
34b8be9d15SRobert Watson.Dt MAC_STUB 4
35aa12cea2SUlrich Spörlein.Os
3617c5113aSChris Costello.Sh NAME
37b8be9d15SRobert Watson.Nm mac_stub
38b8be9d15SRobert Watson.Nd "MAC policy stub module"
3917c5113aSChris Costello.Sh SYNOPSIS
40*50d922a0SGlen BarberTo compile the stub policy
4117c5113aSChris Costellointo your kernel, place the following lines in your kernel
4217c5113aSChris Costelloconfiguration file:
433cc3bf52SRuslan Ermilov.Bd -ragged -offset indent
4417c5113aSChris Costello.Cd "options MAC"
45b8be9d15SRobert Watson.Cd "options MAC_STUB"
463cc3bf52SRuslan Ermilov.Ed
4717c5113aSChris Costello.Pp
48*50d922a0SGlen BarberAlternately, to load the stub module at boot time, place the following line
4917c5113aSChris Costelloin your kernel configuration file:
503cc3bf52SRuslan Ermilov.Bd -ragged -offset indent
5117c5113aSChris Costello.Cd "options MAC"
523cc3bf52SRuslan Ermilov.Ed
5317c5113aSChris Costello.Pp
5417c5113aSChris Costelloand in
5517c5113aSChris Costello.Xr loader.conf 5 :
563cc3bf52SRuslan Ermilov.Bd -literal -offset indent
57b8be9d15SRobert Watsonmac_stub_load="YES"
583cc3bf52SRuslan Ermilov.Ed
5917c5113aSChris Costello.Sh DESCRIPTION
6017c5113aSChris CostelloThe
6117c5113aSChris Costello.Nm
62*50d922a0SGlen Barberpolicy module implements a stub MAC policy that has no effect on
6317c5113aSChris Costelloaccess control in the system.
64a5aea251SChristian BruefferUnlike
6563dc0fa0SChristian Brueffer.Xr mac_none 4 ,
66b8be9d15SRobert Watsoneach MAC entry point is defined as a
67b8be9d15SRobert Watson.Dq no-op ,
68b8be9d15SRobert Watsonso the policy module will be entered for each event, but no change
69b8be9d15SRobert Watsonin system behavior should result.
7017c5113aSChris Costello.Ss Label Format
7117c5113aSChris CostelloNo labels are defined for
7217c5113aSChris Costello.Nm .
7317c5113aSChris Costello.Sh SEE ALSO
74ccf09d7cSChris Costello.Xr mac 4 ,
7517c5113aSChris Costello.Xr mac_biba 4 ,
7617c5113aSChris Costello.Xr mac_bsdextended 4 ,
77057baf37SChris Costello.Xr mac_ifoff 4 ,
789cad8863SChris Costello.Xr mac_lomac 4 ,
7917c5113aSChris Costello.Xr mac_mls 4 ,
80b8be9d15SRobert Watson.Xr mac_none 4 ,
81057baf37SChris Costello.Xr mac_partition 4 ,
820c6e926fSChris Costello.Xr mac_portacl 4 ,
8317c5113aSChris Costello.Xr mac_seeotheruids 4 ,
8417c5113aSChris Costello.Xr mac_test 4 ,
8517c5113aSChris Costello.Xr mac 9
8617c5113aSChris Costello.Sh HISTORY
8717c5113aSChris CostelloThe
8817c5113aSChris Costello.Nm
8917c5113aSChris Costellopolicy module first appeared in
90b8be9d15SRobert Watson.Fx 5.1
913cc3bf52SRuslan Ermilovand was developed by the
923cc3bf52SRuslan Ermilov.Tn TrustedBSD
933cc3bf52SRuslan ErmilovProject.
9417c5113aSChris Costello.Sh AUTHORS
9517c5113aSChris CostelloThis software was contributed to the
9617c5113aSChris Costello.Fx
9717c5113aSChris CostelloProject by Network Associates Labs,
9817c5113aSChris Costellothe Security Research Division of Network Associates
995203edcdSRuslan ErmilovInc.
1005203edcdSRuslan Ermilovunder DARPA/SPAWAR contract N66001-01-C-8035
1013cc3bf52SRuslan Ermilov.Pq Dq CBOSS ,
10217c5113aSChris Costelloas part of the DARPA CHATS research program.
10317c5113aSChris Costello.Sh BUGS
10417c5113aSChris CostelloSee
10517c5113aSChris Costello.Xr mac 9
10617c5113aSChris Costelloconcerning appropriateness for production use.
1073cc3bf52SRuslan ErmilovThe
1083cc3bf52SRuslan Ermilov.Tn TrustedBSD
1093cc3bf52SRuslan ErmilovMAC Framework is considered experimental in
11017c5113aSChris Costello.Fx .
11117c5113aSChris Costello.Pp
11217c5113aSChris CostelloWhile the MAC Framework design is intended to support the containment of
11317c5113aSChris Costellothe root user, not all attack channels are currently protected by entry
11417c5113aSChris Costellopoint checks.
11517c5113aSChris CostelloAs such, MAC Framework policies should not be relied on, in isolation,
11617c5113aSChris Costelloto protect against a malicious privileged user.
117