1 .\" Copyright (c) 2003 Networks Associates Technology, Inc.
2 .\" All rights reserved.
4 .\" This software was developed for the FreeBSD Project by Chris Costello
5 .\" at Safeport Network Services and Network Associates Labs, the
6 .\" Security Research Division of Network Associates, Inc. under
7 .\" DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the
8 .\" DARPA CHATS research program.
10 .\" Redistribution and use in source and binary forms, with or without
11 .\" modification, are permitted provided that the following conditions
13 .\" 1. Redistributions of source code must retain the above copyright
14 .\" notice, this list of conditions and the following disclaimer.
15 .\" 2. Redistributions in binary form must reproduce the above copyright
16 .\" notice, this list of conditions and the following disclaimer in the
17 .\" documentation and/or other materials provided with the distribution.
19 .\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
20 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
23 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
38 .Nd Mandatory Access Control
43 The Mandatory Access Control, or MAC, framework allows administrators to
44 finely control system security by providing for a loadable security policy
46 It is important to note that due to its nature, MAC security policies may
47 only restrict access relative to one another and the base system policy;
48 they cannot override traditional
50 security provisions such as file permissions and superuser checks.
52 Currently, the following MAC policy modules are shipped with
54 .Bl -column ".Xr mac_seeotheruids 4" "ddb(4) interface restrictions" ".Em Labeling" "boot only"
55 .It Sy Name Ta Sy Description Ta Sy Labeling Ta Sy "Load time"
56 .It Xr mac_biba 4 Ta "Biba integrity policy" Ta yes Ta boot only
57 .It Xr mac_bsdextended 4 Ta "File system firewall" Ta no Ta any time
58 .It Xr mac_ddb 4 Ta "ddb(4) interface restrictions" Ta no Ta any time
59 .It Xr mac_ifoff 4 Ta "Interface silencing" Ta no Ta any time
60 .It Xr mac_lomac 4 Ta "Low-Watermark MAC policy" Ta yes Ta boot only
61 .It Xr mac_mls 4 Ta "Confidentiality policy" Ta yes Ta boot only
62 .It Xr mac_ntpd 4 Ta "Non-root NTP Daemon policy" Ta no Ta any time
63 .It Xr mac_partition 4 Ta "Process partition policy" Ta yes Ta any time
64 .It Xr mac_portacl 4 Ta "Port bind(2) access control" Ta no Ta any time
65 .It Xr mac_priority 4 Ta "Scheduling priority policy" Ta no Ta any time
66 .It Xr mac_seeotheruids 4 Ta "See-other-UIDs policy" Ta no Ta any time
67 .It Xr mac_test 4 Ta "MAC testing policy" Ta no Ta any time
70 Each system subject (processes, sockets, etc.) and each system object
71 (file system objects, sockets, etc.) can carry with it a MAC label.
72 MAC labels contain data in an arbitrary format
73 taken into consideration in making access control decisions
74 for a given operation.
75 Most MAC labels on system subjects and objects
76 can be modified directly or indirectly by the system
78 The format for a given policy's label may vary depending on the type
79 of object or subject being labeled.
80 More information on the format for MAC labels can be found in the
83 .Ss MAC Support for UFS2 File Systems
84 By default, file system enforcement of labeled MAC policies relies on
85 a single file system label
88 in order to make access control decisions for all the files in a particular
90 With some policies, this configuration may not allow administrators to take
91 full advantage of features.
92 In order to enable support for labeling files on an individual basis
93 for a particular file system,
96 flag must be enabled on the file system.
99 flag, drop to single-user mode and unmount the file system,
100 then execute the following command:
102 .Dl "tunefs -l enable" Ar filesystem
106 is either the mount point
112 corresponding to the file system on which to enable multilabel support.
113 .Ss Policy Enforcement
114 Policy enforcement is divided into the following areas of the system:
117 File system mounts, modifying directories, modifying files, etc.
119 Loading, unloading, and retrieving statistics on loaded kernel modules
123 packet delivery and transmission,
124 interface configuration
128 Creation of and operation on
142 Creation of and operation on
160 .Ss Setting MAC Labels
161 From the command line, each type of system object has its own means for setting
162 and modifying its MAC policy label.
163 .Bl -column "user (by login class)" "Xr setfmac 8 , Xr setfsmac 8" -offset indent
164 .It Sy "Subject/Object" Ta Sy "Utility"
165 .It "File system object" Ta Xr setfmac 8 , Xr setfsmac 8
166 .It "Network interface" Ta Xr ifconfig 8
167 .It "TTY (by login class)" Ta Xr login.conf 5
168 .It "User (by login class)" Ta Xr login.conf 5
175 utilities can be used to run a command with a different process label than
176 the shell's current label.
177 .Ss Programming With MAC
178 MAC security enforcement itself is transparent to application
179 programs, with the exception that some programs may need to be aware of
182 returns from various system calls.
184 The interface for retrieving, handling, and setting policy labels
189 .\" Support for this feature is poor and should not be encouraged.
191 .\" .It Va security.mac.mmap_revocation
194 .\" access to files on subject relabel.
195 .\" .It Va security.mac.mmap_revocation_via_cow
198 .\" access to files via copy-on-write semantics;
199 .\" mapped regions will still appear writable, but will no longer
200 .\" effect a change on the underlying vnode.
205 .Xr mac_bsdextended 4 ,
212 .Xr mac_partition 4 ,
215 .Xr mac_seeotheruids 4 ,
226 .%B "The FreeBSD Handbook"
227 .%T "Mandatory Access Control"
228 .%U https://docs.FreeBSD.org/en/books/handbook/mac/
233 implementation first appeared in
235 and was developed by the
239 This software was contributed to the
241 Project by Network Associates Labs,
242 the Security Research Division of Network Associates
244 under DARPA/SPAWAR contract N66001-01-C-8035
246 as part of the DARPA CHATS research program.
248 While the MAC Framework design is intended to support the containment of
249 the root user, not all attack channels are currently protected by entry
251 As such, MAC Framework policies should not be relied on, in isolation,
252 to protect against a malicious privileged user.