1 .\" Copyright (c) 2001, 2003 Networks Associates Technology, Inc.
2 .\" All rights reserved.
4 .\" This software was developed for the FreeBSD Project by Chris
5 .\" Costello at Safeport Network Services and Network Associates
6 .\" Laboratories, the Security Research Division of Network Associates,
7 .\" Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part
8 .\" of the DARPA CHATS research program.
10 .\" Redistribution and use in source and binary forms, with or without
11 .\" modification, are permitted provided that the following conditions
13 .\" 1. Redistributions of source code must retain the above copyright
14 .\" notice, this list of conditions and the following disclaimer.
15 .\" 2. Redistributions in binary form must reproduce the above copyright
16 .\" notice, this list of conditions and the following disclaimer in the
17 .\" documentation and/or other materials provided with the distribution.
19 .\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
20 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
23 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
38 .Nd introduction to the MAC security API
44 In the kernel configuration file:
48 permits administrators to define Mandatory Access Control labels
49 defining levels for the privacy and integrity of data,
50 overriding discretionary policies
52 Not all objects currently provide support for MAC labels,
53 and MAC support must be explicitly enabled by the administrator.
54 The library calls include routines to retrieve, duplicate,
55 and set MAC labels associated with files and processes.
57 POSIX.1e describes a set of MAC manipulation routines
58 to manage the contents of MAC labels,
59 as well as their relationships with
61 almost all of these support routines
65 Available functions, sorted by behavior, include:
66 .Bl -tag -width indent
68 This function is described in
70 and may be used to retrieve the
71 MAC label associated with
72 a specific file descriptor.
74 This function is described in
76 and may be used to retrieve the
77 MAC label associated with
80 This function is described in
82 and may be used to retrieve the
83 MAC label associated with
86 This function is described in
88 and may be used to set the
89 MAC label associated with
90 a specific file descriptor.
92 This function is described in
94 and may be used to set the
95 MAC label associated with
98 This function is described in
100 and may be used to set the
101 MAC label associated with
104 This function is described in
106 and may be used to free
107 userland working MAC label storage.
109 This function is described in
111 and may be used to convert
112 a text-form MAC label
116 .It Fn mac_prepare_file_label
117 .It Fn mac_prepare_ifnet_label
118 .It Fn mac_prepare_process_label
119 These functions are described in
121 and may be used to preallocate storage for MAC label retrieval.
123 prepares a label based on caller-specified label names; the other calls
124 rely on the default configuration specified in
127 This function is described in
129 and may be used to convert a
131 into a text-form MAC label.
133 The behavior of some of these calls is influenced by the configuration
136 the MAC library run-time configuration file.
137 .Sh IMPLEMENTATION NOTES
139 support for POSIX.1e interfaces and features
143 .Bl -tag -width ".Pa /etc/mac.conf" -compact
145 MAC library configuration file, documented in
147 Provides default behavior for applications aware of MAC labels on
148 system objects, but without policy-specific knowledge.
160 These APIs are loosely based on the APIs described in POSIX.1e.
161 POSIX.1e is described in IEEE POSIX.1e draft 17.
162 Discussion of the draft
163 continues on the cross-platform POSIX.1e implementation mailing list.
164 To join this list, see the
166 POSIX.1e implementation page
167 for more information.
168 However, the resemblance of these APIs to the POSIX APIs is only loose,
169 as the POSIX APIs were unable to express many notions required for
170 flexible and extensible access control.
172 Support for Mandatory Access Control was introduced in
180 MAC Framework and associated policies, interfaces, and
181 applications are considered to be an experimental feature in
183 Sites considering production deployment should keep the experimental
184 status of these services in mind during any deployment process.
187 for related considerations regarding the kernel framework.