diff options
author | chris <chris@FreeBSD.org> | 2002-12-05 00:05:38 +0000 |
---|---|---|
committer | chris <chris@FreeBSD.org> | 2002-12-05 00:05:38 +0000 |
commit | b7154336a2e44c5cc155547003e3a761754f9bc4 (patch) | |
tree | 6011355b28ad96a0f07ddb38f695bfa878c9aeb3 /share/man/man4/mac_bsdextended.4 | |
parent | adb9b4e9bec41e599dafb4a1adc720a9e55cf10b (diff) | |
download | FreeBSD-src-b7154336a2e44c5cc155547003e3a761754f9bc4.zip FreeBSD-src-b7154336a2e44c5cc155547003e3a761754f9bc4.tar.gz |
Document the following MAC policies:
o Biba: A data integrity policy
o BSD Extended: Support for the firewall-like access controls (ugidfw(8))
o MLS: Multi-level security, a confidentiality policy
(These files originally lived in src/share/man/man9)
Approved by: re (blanket)
Sponsored by: DARPA, Network Associates Labs
Obtained from: TrustedBSD Project
Diffstat (limited to 'share/man/man4/mac_bsdextended.4')
-rw-r--r-- | share/man/man4/mac_bsdextended.4 | 80 |
1 files changed, 80 insertions, 0 deletions
diff --git a/share/man/man4/mac_bsdextended.4 b/share/man/man4/mac_bsdextended.4 new file mode 100644 index 0000000..03bc34a --- /dev/null +++ b/share/man/man4/mac_bsdextended.4 @@ -0,0 +1,80 @@ +.\" Copyright (c) 2002 Networks Associates Technology, Inc. +.\" All rights reserved. +.\" +.\" This software was developed for the FreeBSD Project by Chris +.\" Costello at Safeport Network Services and NAI Labs, the Security +.\" Research Division of Network Associates, Inc. under DARPA/SPAWAR +.\" contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA CHATS +.\" research program. +.\" +.\" Redistribution and use in source and binary forms, with or without +.\" modification, are permitted provided that the following conditions +.\" are met: +.\" 1. Redistributions of source code must retain the above copyright +.\" notice, this list of conditions and the following disclaimer. +.\" 2. Redistributions in binary form must reproduce the above copyright +.\" notice, this list of conditions and the following disclaimer in the +.\" documentation and/or other materials provided with the distribution. +.\" 3. The names of the authors may not be used to endorse or promote +.\" products derived from this software without specific prior written +.\" permission. +.\" +.\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND +.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE +.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +.\" SUCH DAMAGE. +.\" +.\" $FreeBSD$ +.Dd OCTOBER 16, 2002 +.Os +.Dt MAC_BSDEXTENDED 4 +.Sh NAME +.Nm mac_bsdextended +.Nd subject-object interaction rules policy +.Sh SYNOPSIS +.\" .Cd options MAC_BSDEXTENDED +.Li kldload mac_bsdextended +.Sh DESCRIPTION +The +.Nm +interface provides an interface for the system administrator +to impose mandatory rules regarding users and some system objects. +Rules are uploaded to the module +(typically using +.Xr libugidfw 3 ) +where they are stored internally +and used to determine whether to allow or deny specific accesses +(see +.Xr ugidfw 8 ) . +.Sh IMPLEMENTATION NOTES +While the traditional +.Xr mac 9 +entry points are implemented, +policy labels are not used; +instead, access control decisions are made by iterating through the internal +list of rules until a rule +which denies the particular access +is found, +or the end of the list is reached. +.Sh SEE ALSO +.Xr libugidfw 3 , +.Xr ugidfw 8 , +.Xr mac 9 +.Sh HISTORY +The +.Nm +interface was first introduced in +.Fx 5.0 . +.Sh AUTHORS +This software was contributed to the +.Fx +Project by NAI Labs, the Security Research Division of Network Associates +Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), +as part of the DARPA CHATS research program. |