130ee0027SChris Costello.\" Copyright (c) 2002 Networks Associates Technology, Inc. 230ee0027SChris Costello.\" All rights reserved. 330ee0027SChris Costello.\" 430ee0027SChris Costello.\" This software was developed for the FreeBSD Project by Chris Costello 530ee0027SChris Costello.\" at Safeport Network Services and Network Associates Labs, the Security 630ee0027SChris Costello.\" Research Division of Network Associates, Inc. under DARPA/SPAWAR 730ee0027SChris Costello.\" contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA CHATS research 830ee0027SChris Costello.\" program. 930ee0027SChris Costello.\" 1030ee0027SChris Costello.\" Redistribution and use in source and binary forms, with or without 1130ee0027SChris Costello.\" modification, are permitted provided that the following conditions 1230ee0027SChris Costello.\" are met: 1330ee0027SChris Costello.\" 1. Redistributions of source code must retain the above copyright 1430ee0027SChris Costello.\" notice, this list of conditions and the following disclaimer. 1530ee0027SChris Costello.\" 2. Redistributions in binary form must reproduce the above copyright 1630ee0027SChris Costello.\" notice, this list of conditions and the following disclaimer in the 1730ee0027SChris Costello.\" documentation and/or other materials provided with the distribution. 1830ee0027SChris Costello.\" 3. The names of the authors may not be used to endorse or promote 1930ee0027SChris Costello.\" products derived from this software without specific prior written 2030ee0027SChris Costello.\" permission. 2130ee0027SChris Costello.\" 2230ee0027SChris Costello.\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND 2330ee0027SChris Costello.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 2430ee0027SChris Costello.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 2530ee0027SChris Costello.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE 2630ee0027SChris Costello.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 2730ee0027SChris Costello.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 2830ee0027SChris Costello.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 2930ee0027SChris Costello.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 3030ee0027SChris Costello.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 3130ee0027SChris Costello.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 3230ee0027SChris Costello.\" SUCH DAMAGE. 3330ee0027SChris Costello.\" 3430ee0027SChris Costello.\" $FreeBSD$ 3530ee0027SChris Costello.Dd OCTOBER 25, 2002 3630ee0027SChris Costello.Os 3730ee0027SChris Costello.Dt MACLABEL 7 3830ee0027SChris Costello.Sh NAME 3930ee0027SChris Costello.Nm maclabel 4030ee0027SChris Costello.Nd Mandatory Access Control label format 4130ee0027SChris Costello.Sh DESCRIPTION 4230ee0027SChris CostelloIf Mandatory Access Control, or 4330ee0027SChris Costello.Dq MAC , 4430ee0027SChris Costellois enabled in your kernel, 4530ee0027SChris Costellothen in addition to the traditional credentials, 4630ee0027SChris Costelloeach subject 4730ee0027SChris Costello(typically a user or a socket) 4830ee0027SChris Costelloand object 4930ee0027SChris Costello(file system object, socket, etc) 5030ee0027SChris Costellois given a 5130ee0027SChris Costello.Em MAC label . 5230ee0027SChris CostelloThe MAC label specifies the necessary subject-specific or 5330ee0027SChris Costelloobject-specific information necessary for a MAC security policy 5430ee0027SChris Costello.\" .Xr ( mac 9 ) 5530ee0027SChris Costelloto enforce access control on the subject/object. 5630ee0027SChris Costello.Pp 5730ee0027SChris CostelloThe format for a MAC label is defined as follows: 5830ee0027SChris Costello.Dl Sy policy1 Ns No / Ns Sy qualifier1 , Ns Sy policy2 Ns No / Ns Sy qualifier2 , Ns ... 5930ee0027SChris Costello.Pp 6030ee0027SChris CostelloA MAC label consists of a policy name, 6130ee0027SChris Costellofollowed by a forward slash, 6230ee0027SChris Costellofollowed by the subject or object's qualifier, 6330ee0027SChris Costellooptionally followed by a comma and one or more additional policy labels. 6430ee0027SChris CostelloFor example: 6530ee0027SChris Costello.Pp 6630ee0027SChris Costello.Dl Li "biba/low(low-low)" 67e91aeae5SChris Costello.Dl Li "biba/high(low-high),mls/equal(equal-equal),partition/0" 6830ee0027SChris Costello.Sh SEE ALSO 6930ee0027SChris Costello.Xr mac 3 , 7030ee0027SChris Costello.Xr posix1e 3 , 7112cfff28SChris Costello.Xr mac_biba 4 , 7212cfff28SChris Costello.Xr mac_bsdextended 4 , 7312cfff28SChris Costello.Xr mac_ifoff 4 , 7412cfff28SChris Costello.Xr mac_mls 4 , 7512cfff28SChris Costello.Xr mac_none 4 , 7612cfff28SChris Costello.Xr mac_partition 4 , 7712cfff28SChris Costello.Xr mac_seeotheruids 4 , 7812cfff28SChris Costello.Xr mac_test 4 , 7912cfff28SChris Costello.Xr login.conf 5 , 8012cfff28SChris Costello.Xr ifconfig 8 , 8112cfff28SChris Costello.Xr getfmac 8 , 8212cfff28SChris Costello.Xr getpmac 8 , 8312cfff28SChris Costello.Xr setfmac 8 , 8412cfff28SChris Costello.Xr setpmac 8 , 8512cfff28SChris Costello.Xr mac 9 , 8630ee0027SChris Costello.Sh HISTORY 8730ee0027SChris CostelloMAC first appeared in 8830ee0027SChris Costello.Fx 5.0 . 8930ee0027SChris Costello.Sh AUTHORS 9030ee0027SChris CostelloThis software was contributed to the 9130ee0027SChris Costello.Fx 9230ee0027SChris CostelloProject by NAI Labs, the Security Research Division of Network Associates 9330ee0027SChris CostelloInc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), 9430ee0027SChris Costelloas part of the DARPA CHATS research program. 95