| mac_lomac.4 (115211) | mac_lomac.4 (115643) |
|---|---|
| 1.\" Copyright (c) 2002 Networks Associates Technology, Inc. 2.\" All rights reserved. 3.\" 4.\" This software was developed for the FreeBSD Project by Chris Costello 5.\" at Safeport Network Services and Network Associates Laboratories, the 6.\" Security Research Division of Network Associates, Inc. under 7.\" DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the 8.\" DARPA CHATS research program. --- 14 unchanged lines hidden (view full) --- 23.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29.\" SUCH DAMAGE. 30.\" | 1.\" Copyright (c) 2002 Networks Associates Technology, Inc. 2.\" All rights reserved. 3.\" 4.\" This software was developed for the FreeBSD Project by Chris Costello 5.\" at Safeport Network Services and Network Associates Laboratories, the 6.\" Security Research Division of Network Associates, Inc. under 7.\" DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the 8.\" DARPA CHATS research program. --- 14 unchanged lines hidden (view full) --- 23.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29.\" SUCH DAMAGE. 30.\" |
| 31.\" $FreeBSD: head/share/man/man4/mac_lomac.4 115211 2003-05-21 15:55:40Z ru $ | 31.\" $FreeBSD: head/share/man/man4/mac_lomac.4 115643 2003-06-01 21:52:59Z ru $ 32.\" |
| 32.Dd December 11, 2002 33.Os 34.Dt MAC_LOMAC 4 35.Sh NAME 36.Nm mac_lomac | 33.Dd December 11, 2002 34.Os 35.Dt MAC_LOMAC 4 36.Sh NAME 37.Nm mac_lomac |
| 37.Nd Low-watermark Mandatory Access Control data integrity policy | 38.Nd "Low-watermark Mandatory Access Control data integrity policy" |
| 38.Sh SYNOPSIS 39To compile LOMAC into your kernel, place the following lines in your kernel 40configuration file: | 39.Sh SYNOPSIS 40To compile LOMAC into your kernel, place the following lines in your kernel 41configuration file: |
| 42.Bd -ragged -offset indent |
|
| 41.Cd "options MAC" 42.Cd "options MAC_LOMAC" | 43.Cd "options MAC" 44.Cd "options MAC_LOMAC" |
| 45.Ed |
|
| 43.Pp 44Alternately, to load the LOMAC module at boot time, place the following line 45in your kernel configuration file: | 46.Pp 47Alternately, to load the LOMAC module at boot time, place the following line 48in your kernel configuration file: |
| 49.Bd -ragged -offset indent |
|
| 46.Cd "options MAC" | 50.Cd "options MAC" |
| 51.Ed |
|
| 47.Pp 48and in 49.Xr loader.conf 5 : | 52.Pp 53and in 54.Xr loader.conf 5 : |
| 50.Cd mac_lomac_load= Ns \&"YES" | 55.Bd -literal -offset indent 56mac_lomac_load="YES" 57.Ed |
| 51.Sh DESCRIPTION 52The 53.Nm 54policy module implements the LOMAC integrity model, 55which protects the integrity of system objects and subjects by means of 56an information flow policy coupled with the subject demotion 57via floating labels. 58In LOMAC, all system subjects and objects are assigned integrity labels, made --- 4 unchanged lines hidden (view full) --- 63describing the order. 64The hierarchal grade field or fields are expressed 65as a value between 0 and 65535, 66with higher values reflecting higher integrity. 67.Pp 68Three special label component values exist: 69.Bl -column -offset indent ".Sy Label" "dominated by all other labels" 70.It Sy Label Ta Sy Comparison | 58.Sh DESCRIPTION 59The 60.Nm 61policy module implements the LOMAC integrity model, 62which protects the integrity of system objects and subjects by means of 63an information flow policy coupled with the subject demotion 64via floating labels. 65In LOMAC, all system subjects and objects are assigned integrity labels, made --- 4 unchanged lines hidden (view full) --- 70describing the order. 71The hierarchal grade field or fields are expressed 72as a value between 0 and 65535, 73with higher values reflecting higher integrity. 74.Pp 75Three special label component values exist: 76.Bl -column -offset indent ".Sy Label" "dominated by all other labels" 77.It Sy Label Ta Sy Comparison |
| 71.It Li low Ta dominated by all other labels 72.It Li equal Ta equal to all other labels 73.It Li high Ta dominates all other labels | 78.It Li low Ta "dominated by all other labels" 79.It Li equal Ta "equal to all other labels" 80.It Li high Ta "dominates all other labels" |
| 74.El 75.Pp 76The | 81.El 82.Pp 83The |
| 77.Dq high | 84.Dq Li high |
| 78label is assigned to system objects which affect the integrity of the system 79as a whole. | 85label is assigned to system objects which affect the integrity of the system 86as a whole. |
| 80.Dq equal | 87The 88.Dq Li equal 89label |
| 81may be used to indicate that a particular subject or object is exempt from 82the LOMAC protections. 83For example, a label of | 90may be used to indicate that a particular subject or object is exempt from 91the LOMAC protections. 92For example, a label of |
| 84.Dq lomac/equal(equal-equal) | 93.Dq Li lomac/equal(equal-equal) |
| 85might be used on a subject which is to be used to administratively relabel 86anything on the system. 87.Pp 88Almost all system objects are tagged with a single, active label element, 89reflecting the integrity of the object, or integrity of the data contained 90in the object. | 94might be used on a subject which is to be used to administratively relabel 95anything on the system. 96.Pp 97Almost all system objects are tagged with a single, active label element, 98reflecting the integrity of the object, or integrity of the data contained 99in the object. |
| 91Filesystem objects may contain an additional auxiliary label which | 100File system objects may contain an additional auxiliary label which |
| 92determines the inherited integrity level for new files created in a 93directory or the alternate label assumed by the subject upon execution of 94an executable. 95In general, objects labels are represented in the following form: 96.Pp | 101determines the inherited integrity level for new files created in a 102directory or the alternate label assumed by the subject upon execution of 103an executable. 104In general, objects labels are represented in the following form: 105.Pp |
| 97.Dl lomac/ Ns Sy grade Ns [ Sy auxgrade ] | 106.Sm off 107.D1 Li lomac / Ar grade Bq Ar auxgrade 108.Sm on |
| 98.Pp 99For example: 100.Pp 101.Bd -literal -offset indent 102lomac/10[2] 103lomac/low 104.Ed 105.Pp 106Subject labels consist of three label elements: a single (active) label, 107as well as a range of available labels. 108This range is represented using two ordered LOMAC label elements, and when set 109on a process, permits the process to change its active label to any label of 110greater or equal integrity to the low end of the range, and lesser or equal 111integrity to the high end of the range. 112In general, subject labels are represented in the following form: 113.Pp | 109.Pp 110For example: 111.Pp 112.Bd -literal -offset indent 113lomac/10[2] 114lomac/low 115.Ed 116.Pp 117Subject labels consist of three label elements: a single (active) label, 118as well as a range of available labels. 119This range is represented using two ordered LOMAC label elements, and when set 120on a process, permits the process to change its active label to any label of 121greater or equal integrity to the low end of the range, and lesser or equal 122integrity to the high end of the range. 123In general, subject labels are represented in the following form: 124.Pp |
| 114.Dl lomac/ Ns Sy singlegrade Ns ( Sy lograde Ns - Ns Sy higrade ) | 125.Sm off 126.D1 Li lomac / Ar singlegrade ( lograde No - Ar higrade ) 127.Sm on |
| 115.Pp 116Modification of objects is restricted to access via the following comparison: 117.Pp | 128.Pp 129Modification of objects is restricted to access via the following comparison: 130.Pp |
| 118.Dl subject::higrade >= target-object::grade | 131.D1 Ar subject Ns :: Ns Ar higrade No \[>=] Ar target-object Ns :: Ns Ar grade |
| 119.Pp 120Modification of subjects is the same, as the target subject's single grade 121is the only element taken into comparison. 122.Pp 123Demotion of a subject occurs when the following comparison is true: 124.Pp | 132.Pp 133Modification of subjects is the same, as the target subject's single grade 134is the only element taken into comparison. 135.Pp 136Demotion of a subject occurs when the following comparison is true: 137.Pp |
| 125.Dl subject::singlegrade > object::grade | 138.D1 Ar subject Ns :: Ns Ar singlegrade No > Ar object Ns :: Ns Ar grade |
| 126.Pp | 139.Pp |
| 127When demotion occurs, the subject's singlegrade and higrade are reduced to the 128object's grade, as well as the lograde if necessary. | 140When demotion occurs, the subject's 141.Ar singlegrade 142and 143.Ar higrade 144are reduced to the 145object's grade, as well as the 146.Ar lograde 147if necessary. |
| 129When the demotion occurs, in addition to the permission of the subject being 130reduced, shared 131.Xr mmap 2 132objects which it has opened in its memory space may be revoked according to 133the following 134.Xr sysctl 2 135variables: | 148When the demotion occurs, in addition to the permission of the subject being 149reduced, shared 150.Xr mmap 2 151objects which it has opened in its memory space may be revoked according to 152the following 153.Xr sysctl 2 154variables: |
| 136.Bl -bullet | 155.Pp 156.Bl -bullet -compact |
| 137.It 138.Va security.mac.lomac.revocation_enabled 139.It 140.Va security.mac.enforce_vm 141.It 142.Va security.mac.mmap_revocation 143.It 144.Va security.mac.mmap_revocation_via_cow 145.El 146.Pp 147Upon execution of a file, if the executable has an auxiliary label, and that 148label is within the current range of | 157.It 158.Va security.mac.lomac.revocation_enabled 159.It 160.Va security.mac.enforce_vm 161.It 162.Va security.mac.mmap_revocation 163.It 164.Va security.mac.mmap_revocation_via_cow 165.El 166.Pp 167Upon execution of a file, if the executable has an auxiliary label, and that 168label is within the current range of |
| 149.Sy lograde-higrade , | 169.Ar lograde Ns - Ns Ar higrade , |
| 150it will be assumed by the subject immediately. 151After this, demotion is performed just as with any other read operation, with 152the executable as the target. 153Through the use of auxiliary labels, programs may be initially executed 154at a lower effective integrity level, 155while retaining the ability to raise it again. 156.Pp 157These rules prevent subjects of lower integrity from influencing the --- 25 unchanged lines hidden (view full) --- 183.Xr mac_seeotheruids 4 , 184.Xr mac_test 4 , 185.Xr mac 9 186.Sh HISTORY 187The 188.Nm 189policy module first appeared in 190.Fx 5.0 | 170it will be assumed by the subject immediately. 171After this, demotion is performed just as with any other read operation, with 172the executable as the target. 173Through the use of auxiliary labels, programs may be initially executed 174at a lower effective integrity level, 175while retaining the ability to raise it again. 176.Pp 177These rules prevent subjects of lower integrity from influencing the --- 25 unchanged lines hidden (view full) --- 203.Xr mac_seeotheruids 4 , 204.Xr mac_test 4 , 205.Xr mac 9 206.Sh HISTORY 207The 208.Nm 209policy module first appeared in 210.Fx 5.0 |
| 191and was developed by the TrustedBSD Project. | 211and was developed by the 212.Tn TrustedBSD 213Project. |
| 192.Sh AUTHORS 193This software was contributed to the 194.Fx 195Project by Network Associates Labs, 196the Security Research Division of Network Associates | 214.Sh AUTHORS 215This software was contributed to the 216.Fx 217Project by Network Associates Labs, 218the Security Research Division of Network Associates |
| 197Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), | 219Inc. under DARPA/SPAWAR contract N66001-01-C-8035 220.Pq Dq CBOSS , |
| 198as part of the DARPA CHATS research program. | 221as part of the DARPA CHATS research program. |