1 .\" Copyright (c) 2003 Networks Associates Technology, Inc.
2 .\" All rights reserved.
4 .\" This software was developed for the FreeBSD Project in part by Network
5 .\" Associates Laboratories, the Security Research Division of Network
6 .\" Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
7 .\" as part of the DARPA CHATS research program.
9 .\" Redistribution and use in source and binary forms, with or without
10 .\" modification, are permitted provided that the following conditions
12 .\" 1. Redistributions of source code must retain the above copyright
13 .\" notice, this list of conditions and the following disclaimer.
14 .\" 2. Redistributions in binary form must reproduce the above copyright
15 .\" notice, this list of conditions and the following disclaimer in the
16 .\" documentation and/or other materials provided with the distribution.
18 .\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
19 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
22 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
37 .Nd format of the MAC library configuration file
41 file configures the default label elements to be used by policy-agnostic
42 applications that operate on MAC labels.
43 A file contains a series of default label sets specified by object class,
44 in addition to blank lines and comments preceded by a
48 Currently, the implementation supports two syntax styles for label
50 The old (deprecated) syntax consists of a
51 single line with two fields separated by white space: the object
52 class name, and a list of label elements as used by the
54 library calls prior to an application invocation of a function from
57 The newer more preferred syntax consists of three fields separated by
58 white space: the label group, object class name and a list of
61 Label element names may optionally begin with a
63 symbol to indicate that a failure to retrieve the label element for
64 an object should be silently ignored, and improves usability if the
65 set of MAC policies may change over time.
67 .Bl -tag -width ".Pa /etc/mac.conf" -compact
69 MAC library configuration file.
72 The following example configures user applications to operate with
79 .Bd -literal -offset indent
81 # Default label set to be used by simple MAC applications
83 default_labels file ?biba,?lomac,?mls,?sebsd
84 default_labels ifnet ?biba,?lomac,?mls,?sebsd
85 default_labels process ?biba,?lomac,?mls,?partition,?sebsd
86 default_labels socket ?biba,?lomac,?mls
89 # Deprecated (old) syntax
91 default_file_labels ?biba,?mls,?sebsd
92 default_ifnet_labels ?biba,?mls,?sebsd
93 default_process_labels ?biba,?mls,partition,?sebsd
96 In this example, userland applications will attempt to retrieve Biba,
97 MLS, and SEBSD labels for all object classes; for processes, they will
98 additionally attempt to retrieve a Partition identifier.
99 In all cases except the Partition identifier, failure to retrieve a
100 label due to the respective policy not being present will be ignored.
108 Support for Mandatory Access Control was introduced in
116 MAC Framework and associated policies, interfaces, and
117 applications are considered to be an experimental feature in
119 Sites considering production deployment should keep the experimental
120 status of these services in mind during any deployment process.
123 for related considerations regarding the kernel framework.