130ee0027SChris Costello.\" Copyright (c) 2002 Networks Associates Technology, Inc. 230ee0027SChris Costello.\" All rights reserved. 330ee0027SChris Costello.\" 430ee0027SChris Costello.\" This software was developed for the FreeBSD Project by Chris Costello 530ee0027SChris Costello.\" at Safeport Network Services and Network Associates Labs, the Security 630ee0027SChris Costello.\" Research Division of Network Associates, Inc. under DARPA/SPAWAR 730ee0027SChris Costello.\" contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA CHATS research 830ee0027SChris Costello.\" program. 930ee0027SChris Costello.\" 1030ee0027SChris Costello.\" Redistribution and use in source and binary forms, with or without 1130ee0027SChris Costello.\" modification, are permitted provided that the following conditions 1230ee0027SChris Costello.\" are met: 1330ee0027SChris Costello.\" 1. Redistributions of source code must retain the above copyright 1430ee0027SChris Costello.\" notice, this list of conditions and the following disclaimer. 1530ee0027SChris Costello.\" 2. Redistributions in binary form must reproduce the above copyright 1630ee0027SChris Costello.\" notice, this list of conditions and the following disclaimer in the 1730ee0027SChris Costello.\" documentation and/or other materials provided with the distribution. 1830ee0027SChris Costello.\" 3. The names of the authors may not be used to endorse or promote 1930ee0027SChris Costello.\" products derived from this software without specific prior written 2030ee0027SChris Costello.\" permission. 2130ee0027SChris Costello.\" 2230ee0027SChris Costello.\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND 2330ee0027SChris Costello.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 2430ee0027SChris Costello.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 2530ee0027SChris Costello.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE 2630ee0027SChris Costello.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 2730ee0027SChris Costello.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 2830ee0027SChris Costello.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 2930ee0027SChris Costello.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 3030ee0027SChris Costello.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 3130ee0027SChris Costello.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 3230ee0027SChris Costello.\" SUCH DAMAGE. 3330ee0027SChris Costello.\" 34f937c268SRuslan Ermilov.Dd October 25, 2002 3530ee0027SChris Costello.Dt MACLABEL 7 36*aa12cea2SUlrich Spörlein.Os 3730ee0027SChris Costello.Sh NAME 3830ee0027SChris Costello.Nm maclabel 3930ee0027SChris Costello.Nd Mandatory Access Control label format 4030ee0027SChris Costello.Sh DESCRIPTION 41f937c268SRuslan ErmilovIf Mandatory Access Control, or MAC, is enabled in the kernel, 4230ee0027SChris Costellothen in addition to the traditional credentials, 4330ee0027SChris Costelloeach subject 4430ee0027SChris Costello(typically a user or a socket) 4530ee0027SChris Costelloand object 46f937c268SRuslan Ermilov(file system object, socket, etc.\&) 4730ee0027SChris Costellois given a 48f937c268SRuslan Ermilov.Em "MAC label" . 4930ee0027SChris CostelloThe MAC label specifies the necessary subject-specific or 5030ee0027SChris Costelloobject-specific information necessary for a MAC security policy 51f937c268SRuslan Ermilov.\" .Pq Xr mac 9 5230ee0027SChris Costelloto enforce access control on the subject/object. 5330ee0027SChris Costello.Pp 5430ee0027SChris CostelloThe format for a MAC label is defined as follows: 55f937c268SRuslan Ermilov.Pp 56f937c268SRuslan Ermilov.Sm off 57f937c268SRuslan Ermilov.D1 Ar policy1 No / Ar qualifier1 , policy2 No / Ar qualifier2 , No ... 58f937c268SRuslan Ermilov.Sm on 5930ee0027SChris Costello.Pp 6030ee0027SChris CostelloA MAC label consists of a policy name, 6130ee0027SChris Costellofollowed by a forward slash, 6230ee0027SChris Costellofollowed by the subject or object's qualifier, 6330ee0027SChris Costellooptionally followed by a comma and one or more additional policy labels. 6430ee0027SChris CostelloFor example: 65f937c268SRuslan Ermilov.Bd -literal -offset indent 66f937c268SRuslan Ermilovbiba/low(low-low) 67f937c268SRuslan Ermilovbiba/high(low-high),mls/equal(equal-equal),partition/0 68f937c268SRuslan Ermilov.Ed 6930ee0027SChris Costello.Sh SEE ALSO 7030ee0027SChris Costello.Xr mac 3 , 7130ee0027SChris Costello.Xr posix1e 3 , 7212cfff28SChris Costello.Xr mac_biba 4 , 7312cfff28SChris Costello.Xr mac_bsdextended 4 , 7412cfff28SChris Costello.Xr mac_ifoff 4 , 7512cfff28SChris Costello.Xr mac_mls 4 , 7612cfff28SChris Costello.Xr mac_none 4 , 7712cfff28SChris Costello.Xr mac_partition 4 , 7812cfff28SChris Costello.Xr mac_seeotheruids 4 , 7912cfff28SChris Costello.Xr mac_test 4 , 8012cfff28SChris Costello.Xr login.conf 5 , 8112cfff28SChris Costello.Xr getfmac 8 , 8212cfff28SChris Costello.Xr getpmac 8 , 83f937c268SRuslan Ermilov.Xr ifconfig 8 , 8412cfff28SChris Costello.Xr setfmac 8 , 8512cfff28SChris Costello.Xr setpmac 8 , 86f937c268SRuslan Ermilov.Xr mac 9 8730ee0027SChris Costello.Sh HISTORY 8830ee0027SChris CostelloMAC first appeared in 8930ee0027SChris Costello.Fx 5.0 . 9030ee0027SChris Costello.Sh AUTHORS 9130ee0027SChris CostelloThis software was contributed to the 9230ee0027SChris Costello.Fx 9330ee0027SChris CostelloProject by NAI Labs, the Security Research Division of Network Associates 945203edcdSRuslan ErmilovInc.\& under DARPA/SPAWAR contract N66001-01-C-8035 95f937c268SRuslan Ermilov.Pq Dq CBOSS , 9630ee0027SChris Costelloas part of the DARPA CHATS research program. 97