diff options
author | chris <chris@FreeBSD.org> | 2002-10-28 22:54:54 +0000 |
---|---|---|
committer | chris <chris@FreeBSD.org> | 2002-10-28 22:54:54 +0000 |
commit | 5d8d9df155b772995d90816aa7974e887cb851c2 (patch) | |
tree | 28ca703e16da092e420e45eac3c2c997b8bd68f3 /share/man/man7 | |
parent | 36b357552e8bf68a082895a618ce8fc14d7b21a8 (diff) | |
download | FreeBSD-src-5d8d9df155b772995d90816aa7974e887cb851c2.zip FreeBSD-src-5d8d9df155b772995d90816aa7974e887cb851c2.tar.gz |
Add a man page describing the Mandatory Access Control label format.
Obtained from: TrustedBSD Project
Sponsored by: DARPA, Network Associates Labs
Diffstat (limited to 'share/man/man7')
-rw-r--r-- | share/man/man7/Makefile | 2 | ||||
-rw-r--r-- | share/man/man7/maclabel.7 | 80 |
2 files changed, 81 insertions, 1 deletions
diff --git a/share/man/man7/Makefile b/share/man/man7/Makefile index 5af0c7d..0980795 100644 --- a/share/man/man7/Makefile +++ b/share/man/man7/Makefile @@ -3,7 +3,7 @@ #MISSING: eqnchar.7 ms.7 term.7 MAN= ascii.7 build.7 clocks.7 environ.7 firewall.7 ffs.7 hier.7 \ - hostname.7 intro.7 mailaddr.7 operator.7 ports.7 release.7 \ + hostname.7 intro.7 maclabel.7 mailaddr.7 operator.7 ports.7 release.7 \ sdoc.7 security.7 sprog.7 stdint.7 tuning.7 MLINKS= intro.7 miscellaneous.7 diff --git a/share/man/man7/maclabel.7 b/share/man/man7/maclabel.7 new file mode 100644 index 0000000..141656e --- /dev/null +++ b/share/man/man7/maclabel.7 @@ -0,0 +1,80 @@ +.\" Copyright (c) 2002 Networks Associates Technology, Inc. +.\" All rights reserved. +.\" +.\" This software was developed for the FreeBSD Project by Chris Costello +.\" at Safeport Network Services and Network Associates Labs, the Security +.\" Research Division of Network Associates, Inc. under DARPA/SPAWAR +.\" contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA CHATS research +.\" program. +.\" +.\" Redistribution and use in source and binary forms, with or without +.\" modification, are permitted provided that the following conditions +.\" are met: +.\" 1. Redistributions of source code must retain the above copyright +.\" notice, this list of conditions and the following disclaimer. +.\" 2. Redistributions in binary form must reproduce the above copyright +.\" notice, this list of conditions and the following disclaimer in the +.\" documentation and/or other materials provided with the distribution. +.\" 3. The names of the authors may not be used to endorse or promote +.\" products derived from this software without specific prior written +.\" permission. +.\" +.\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND +.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE +.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +.\" SUCH DAMAGE. +.\" +.\" $FreeBSD$ +.Dd OCTOBER 25, 2002 +.Os +.Dt MACLABEL 7 +.Sh NAME +.Nm maclabel +.Nd Mandatory Access Control label format +.Sh DESCRIPTION +If Mandatory Access Control, or +.Dq MAC , +is enabled in your kernel, +then in addition to the traditional credentials, +each subject +(typically a user or a socket) +and object +(file system object, socket, etc) +is given a +.Em MAC label . +The MAC label specifies the necessary subject-specific or +object-specific information necessary for a MAC security policy +.\" .Xr ( mac 9 ) +to enforce access control on the subject/object. +.Pp +The format for a MAC label is defined as follows: +.Dl Sy policy1 Ns No / Ns Sy qualifier1 , Ns Sy policy2 Ns No / Ns Sy qualifier2 , Ns ... +.Pp +A MAC label consists of a policy name, +followed by a forward slash, +followed by the subject or object's qualifier, +optionally followed by a comma and one or more additional policy labels. +For example: +.Pp +.Dl Li "biba/low(low-low)" +.Dl Li "biba/high(low-high),te/equal(equal-equal),partition/0" +.Sh SEE ALSO +.Xr mac 3 , +.Xr posix1e 3 , +.Xr mac 9 +.Sh HISTORY +MAC first appeared in +.Fx 5.0 . +.Sh AUTHORS +This software was contributed to the +.Fx +Project by NAI Labs, the Security Research Division of Network Associates +Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), +as part of the DARPA CHATS research program. |