diff options
author | chris <chris@FreeBSD.org> | 2002-12-11 01:02:26 +0000 |
---|---|---|
committer | chris <chris@FreeBSD.org> | 2002-12-11 01:02:26 +0000 |
commit | e02dd1a36824ccac4d00b67de238450d2bcb632e (patch) | |
tree | a4f43ee93d57d2a22636a0f631dbf98ad004cdd5 /share | |
parent | 9050c80f1d277e50e7dfe4b63b70df26c4984a57 (diff) | |
download | FreeBSD-src-e02dd1a36824ccac4d00b67de238450d2bcb632e.zip FreeBSD-src-e02dd1a36824ccac4d00b67de238450d2bcb632e.tar.gz |
Document the following MAC policies:
o ifoff: Interface silencing policy
o partition: Process partitioning policy
Add associated Makefile entries and man page cross-references.
Obtained from: TrustedBSD Project
Sponsored by: DARPA, Network Associates Labs
Approved by: re (blanket)
Diffstat (limited to 'share')
-rw-r--r-- | share/man/man4/Makefile | 2 | ||||
-rw-r--r-- | share/man/man4/mac_biba.4 | 2 | ||||
-rw-r--r-- | share/man/man4/mac_bsdextended.4 | 2 | ||||
-rw-r--r-- | share/man/man4/mac_ifoff.4 | 127 | ||||
-rw-r--r-- | share/man/man4/mac_mls.4 | 2 | ||||
-rw-r--r-- | share/man/man4/mac_none.4 | 2 | ||||
-rw-r--r-- | share/man/man4/mac_partition.4 | 116 | ||||
-rw-r--r-- | share/man/man4/mac_seeotheruids.4 | 2 | ||||
-rw-r--r-- | share/man/man4/mac_stub.4 | 2 | ||||
-rw-r--r-- | share/man/man4/mac_test.4 | 2 |
10 files changed, 259 insertions, 0 deletions
diff --git a/share/man/man4/Makefile b/share/man/man4/Makefile index ee1527c..e0ecadc 100644 --- a/share/man/man4/Makefile +++ b/share/man/man4/Makefile @@ -97,8 +97,10 @@ MAN= aac.4 \ mly.4 \ mac_biba.4 \ mac_bsdextended.4 \ + mac_ifoff.4 \ mac_mls.4 \ mac_none.4 \ + mac_partition4. \ mac_seeotheruids.4 \ mac_test.4 \ mouse.4 \ diff --git a/share/man/man4/mac_biba.4 b/share/man/man4/mac_biba.4 index d96222a..ca645f9 100644 --- a/share/man/man4/mac_biba.4 +++ b/share/man/man4/mac_biba.4 @@ -176,8 +176,10 @@ integrity, of subjects and objects. .Sh SEE ALSO .Xr LOMAC 4 , .Xr mac_bsdextended 4 , +.Xr mac_ifoff 4 , .Xr mac_mls 4 , .Xr mac_none 4 , +.Xr mac_partition 4 , .Xr mac_seeotheruids 4 , .Xr mac_test 4 , .Xr mac 9 diff --git a/share/man/man4/mac_bsdextended.4 b/share/man/man4/mac_bsdextended.4 index 79be140..e84e6ea 100644 --- a/share/man/man4/mac_bsdextended.4 +++ b/share/man/man4/mac_bsdextended.4 @@ -79,8 +79,10 @@ or the end of the list is reached. .Sh SEE ALSO .Xr libugidfw 3 , .Xr mac_biba 4 , +.Xr mac_ifoff 4 , .Xr mac_mls 4 , .Xr mac_none 4 , +.Xr mac_partition 4 , .Xr mac_seeotheruids 4 , .Xr mac_test 4 , .Xr ugidfw 8 , diff --git a/share/man/man4/mac_ifoff.4 b/share/man/man4/mac_ifoff.4 new file mode 100644 index 0000000..1cd8765 --- /dev/null +++ b/share/man/man4/mac_ifoff.4 @@ -0,0 +1,127 @@ +.\" Copyright (c) 2002 Networks Associates Technology, Inc. +.\" All rights reserved. +.\" +.\" This software was developed for the FreeBSD Project by Chris +.\" Costello at Safeport Network Services and Network Associates Labs, +.\" the Security Research Division of Network Associates, Inc. under +.\" DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the +.\" DARPA CHATS research program. +.\" +.\" Redistribution and use in source and binary forms, with or without +.\" modification, are permitted provided that the following conditions +.\" are met: +.\" 1. Redistributions of source code must retain the above copyright +.\" notice, this list of conditions and the following disclaimer. +.\" 2. Redistributions in binary form must reproduce the above copyright +.\" notice, this list of conditions and the following disclaimer in the +.\" documentation and/or other materials provided with the distribution. +.\" +.\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND +.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE +.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +.\" SUCH DAMAGE. +.\" +.\" $FreeBSD$ +.Dd DECEMBER 10, 2002 +.Os +.Dt MAC_IFOFF 4 +.Sh NAME +.Nm mac_ifoff +.Nd interface silencing policy +.Sh SYNOPSIS +To compile the interface silencing policy into your kernel, +place the following lines in your kernel +configuration file: +.Cd "options MAC" +.Cd "options MAC_IFOFF" +.Pp +Alternately, to load the interface silencing policy module at boot time, +place the following line in your kernel configuration file: +.Cd "options MAC" +.Pp +and in +.Xr loader.conf 5 : +.Cd mac_ifoff_load= Ns \&"YES" +.Sh DESCRIPTION +The +.Nm +interface silencing module allows administrators to enable and disable +incoming and outgoing data flow on system network interfaces +via the +.Xr sysctl 8 +interface. +.Pp +To disable network traffic over the loopback +.Xr ( lo 4 ) +interface, set the +.Xr sysctl 8 +OID +.Va security.mac.ifoff.lo_enabled +to +.Li 0 +(default +.Li 1 ) . +.Pp +To enable network traffic over other interfaces, +set the +.Xr sysctl 8 +OID +.Va security.mac.ifoff.other_enabled +to +.Li 1 +(default +.Li 0 ) . +.Pp +To allow BPF traffic to be received, +even while other traffic is disabled, +set the +.Xr sysctl 8 +OID +.Va security.mac.ifoff.bpfrecv_enabled +to +.Li 1 +(default +.Li 0 ) . +.Ss Label Format +No labels are defined. +.Sh SEE ALSO +.Xr lomac 4 , +.Xr mac_bsdextended 4 , +.Xr mac_mls 4 , +.Xr mac_none 4 , +.Xr mac_partition 4 , +.Xr mac_seeotheruids 4 , +.Xr mac_test 4 , +.Xr mac 9 +.Sh HISTORY +The +.Nm +policy module first appeared in +.Fx 5.0 +and was developed by the TrustedBSD Project. +.Sh AUTHORS +This software was contributed to the +.Fx +Project by Network Associates Labs, +the Security Research Division of Network Associates +Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), +as part of the DARPA CHATS research program. +.Sh BUGS +See +.Xr mac 9 +concerning appropriateness for production use. +The TrustedBSD MAC Framework is considered experimental in +.Fx . +.Pp +While the MAC Framework design is intended to support the containment of +the root user, not all attack channels are currently protected by entry +point checks. +As such, MAC Framework policies should not be relied on, in isolation, +to protect against a malicious privileged user. diff --git a/share/man/man4/mac_mls.4 b/share/man/man4/mac_mls.4 index 46459a0..b6c555a 100644 --- a/share/man/man4/mac_mls.4 +++ b/share/man/man4/mac_mls.4 @@ -174,8 +174,10 @@ allow the superuser to bypass MLS protections. .Sh SEE ALSO .Xr mac_biba 4 , .Xr mac_bsdextended 4 , +.Xr mac_ifoff 4 , .Xr mac_mls 4 , .Xr mac_none 4 , +.Xr mac_partition 4 , .Xr mac_seeotheruids 4 , .Xr mac_test 4 .Xr maclabel 7 , diff --git a/share/man/man4/mac_none.4 b/share/man/man4/mac_none.4 index bfcf1eb..e8cfeda 100644 --- a/share/man/man4/mac_none.4 +++ b/share/man/man4/mac_none.4 @@ -62,7 +62,9 @@ No labels are defined for .Sh SEE ALSO .Xr mac_biba 4 , .Xr mac_bsdextended 4 , +.Xr mac_ifoff 4 , .Xr mac_mls 4 , +.Xr mac_partition 4 , .Xr mac_seeotheruids 4 , .Xr mac_test 4 , .Xr mac 9 diff --git a/share/man/man4/mac_partition.4 b/share/man/man4/mac_partition.4 new file mode 100644 index 0000000..5fe5350 --- /dev/null +++ b/share/man/man4/mac_partition.4 @@ -0,0 +1,116 @@ +.\" Copyright (c) 2002 Networks Associates Technology, Inc. +.\" All rights reserved. +.\" +.\" This software was developed for the FreeBSD Project by Chris +.\" Costello at Safeport Network Services and Network Associates Labs, +.\" the Security Research Division of Network Associates, Inc. under +.\" DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the +.\" DARPA CHATS research program. +.\" +.\" Redistribution and use in source and binary forms, with or without +.\" modification, are permitted provided that the following conditions +.\" are met: +.\" 1. Redistributions of source code must retain the above copyright +.\" notice, this list of conditions and the following disclaimer. +.\" 2. Redistributions in binary form must reproduce the above copyright +.\" notice, this list of conditions and the following disclaimer in the +.\" documentation and/or other materials provided with the distribution. +.\" +.\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND +.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE +.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +.\" SUCH DAMAGE. +.\" +.\" $FreeBSD$ +.Dd DECEMBER 9, 2002 +.Os +.Dt MAC_PARTITION 4 +.Sh NAME +.Nm mac_partition +.Nd process partition policy +.Sh SYNOPSIS +To compile the process partition policy into your kernel, +place the following lines in your kernel +configuration file: +.Cd "options MAC" +.Cd "options MAC_PARTITION" +.Pp +Alternately, to load the process partition module at boot time, +place the following line in your kernel configuration file: +.Cd "options MAC" +.Pp +and in +.Xr loader.conf 5 : +.Cd mac_partition_load= Ns \&"YES" +.Sh DESCRIPTION +The +.Nm +policy module implements a process partition policy, +which allows administrators to place running processes into +.Dq partitions, +based on their numeric process partition +(specified in the process's MAC label). +Processes with a specified partition can only see processes that are in the +same partition. +If no partition is specified for a process, it can see all other processes +in the system +(subject to other MAC policy restrictions not defined in this man page). +No provisions for placing processes into multiple partitions is available. +.Ss Label Format +Partition labels take on the following format: +.Pp +.Dl partition/ Ns Sy value +.Pp +Where +.Sy value +can be any integer value or +.Dq none . +For example: +.Pp +.Bd -offset indent +partition/1 +partition/20 +partition/none +.Ed +.Sh SEE ALSO +.Xr LOMAC 4 , +.Xr mac_biba 4 , +.Xr mac_bsdextended 4 , +.Xr mac_ifoff 4 , +.Xr mac_mls 4 , +.Xr mac_none 4 , +.Xr mac_seeotheruids 4 , +.Xr mac_test 4 , +.Xr mac 9 +.Sh HISTORY +The +.Nm +policy module first appeared in +.Fx 5.0 +and was developed by the TrustedBSD Project. +.Sh AUTHORS +This software was contributed to the +.Fx +Project by Network Associates Labs, +the Security Research Division of Network Associates +Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), +as part of the DARPA CHATS research program. +.Sh BUGS +See +.Xr mac 9 +concerning appropriateness for production use. +The TrustedBSD MAC Framework is considered experimental in +.Fx . +.Pp +While the MAC Framework design is intended to support the containment of +the root user, not all attack channels are currently protected by entry +point checks. +As such, MAC Framework policies should not be relied on, in isolation, +to protect against a malicious privileged user. diff --git a/share/man/man4/mac_seeotheruids.4 b/share/man/man4/mac_seeotheruids.4 index a39f0be..dd38857 100644 --- a/share/man/man4/mac_seeotheruids.4 +++ b/share/man/man4/mac_seeotheruids.4 @@ -82,7 +82,9 @@ No labels are defined for .Sh SEE ALSO .Xr mac_biba 4 , .Xr mac_bsdextended 4 , +.Xr mac_ifoff 4 , .Xr mac_mls 4 , +.Xr mac_partition 4 , .Xr mac_none 4 , .Xr mac_test 4 , .Xr mac 9 diff --git a/share/man/man4/mac_stub.4 b/share/man/man4/mac_stub.4 index bfcf1eb..e8cfeda 100644 --- a/share/man/man4/mac_stub.4 +++ b/share/man/man4/mac_stub.4 @@ -62,7 +62,9 @@ No labels are defined for .Sh SEE ALSO .Xr mac_biba 4 , .Xr mac_bsdextended 4 , +.Xr mac_ifoff 4 , .Xr mac_mls 4 , +.Xr mac_partition 4 , .Xr mac_seeotheruids 4 , .Xr mac_test 4 , .Xr mac 9 diff --git a/share/man/man4/mac_test.4 b/share/man/man4/mac_test.4 index f44f059..86e3ad6 100644 --- a/share/man/man4/mac_test.4 +++ b/share/man/man4/mac_test.4 @@ -68,8 +68,10 @@ No labels are defined for .Sh SEE ALSO .Xr mac_biba 4 , .Xr mac_bsdextended 4 , +.Xr mac_ifoff 4 , .Xr mac_mls 4 , .Xr mac_none 4 , +.Xr mac_partition 4 , .Xr mac_seeotheruids 4 , .Xr mac 9 .Sh HISTORY |