1.\" Copyright (c) 2002 Networks Associates Technology, Inc. 2.\" All rights reserved. 3.\" 4.\" This software was developed for the FreeBSD Project by Chris Costello 5.\" at Safeport Network Services and Network Associates Laboratories, the 6.\" Security Research Division of Network Associates, Inc. under 7.\" DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the 8.\" DARPA CHATS research program. 9.\" 10.\" Redistribution and use in source and binary forms, with or without 11.\" modification, are permitted provided that the following conditions 12.\" are met: 13.\" 1. Redistributions of source code must retain the above copyright 14.\" notice, this list of conditions and the following disclaimer. 15.\" 2. Redistributions in binary form must reproduce the above copyright 16.\" notice, this list of conditions and the following disclaimer in the 17.\" documentation and/or other materials provided with the distribution. 18.\" 19.\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND 20.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE 23.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29.\" SUCH DAMAGE. 30.\" 31.\" $FreeBSD$ 32.\" 33.Dd December 11, 2002 34.Os 35.Dt MAC_LOMAC 4 36.Sh NAME 37.Nm mac_lomac 38.Nd "Low-watermark Mandatory Access Control data integrity policy" 39.Sh SYNOPSIS 40To compile LOMAC into your kernel, place the following lines in your kernel 41configuration file: 42.Bd -ragged -offset indent 43.Cd "options MAC" 44.Cd "options MAC_LOMAC" 45.Ed 46.Pp 47Alternately, to load the LOMAC module at boot time, place the following line 48in your kernel configuration file: 49.Bd -ragged -offset indent 50.Cd "options MAC" 51.Ed 52.Pp 53and in 54.Xr loader.conf 5 : 55.Bd -literal -offset indent 56mac_lomac_load="YES" 57.Ed 58.Sh DESCRIPTION 59The 60.Nm 61policy module implements the LOMAC integrity model, 62which protects the integrity of system objects and subjects by means of 63an information flow policy coupled with the subject demotion 64via floating labels. 65In LOMAC, all system subjects and objects are assigned integrity labels, made 66up of one or more hierarchal grades, depending on the their types. 67Together, these label elements permit all labels to be placed in a partial 68order, with information flow protections and demotion decisions 69based on a dominance operator 70describing the order. 71The hierarchal grade field or fields are expressed 72as a value between 0 and 65535, 73with higher values reflecting higher integrity. 74.Pp 75Three special label component values exist: 76.Bl -column -offset indent ".Sy Label" "dominated by all other labels" 77.It Sy Label Ta Sy Comparison 78.It Li low Ta "dominated by all other labels" 79.It Li equal Ta "equal to all other labels" 80.It Li high Ta "dominates all other labels" 81.El 82.Pp 83The 84.Dq Li high 85label is assigned to system objects which affect the integrity of the system 86as a whole. 87The 88.Dq Li equal 89label 90may be used to indicate that a particular subject or object is exempt from 91the LOMAC protections. 92For example, a label of 93.Dq Li lomac/equal(equal-equal) 94might be used on a subject which is to be used to administratively relabel 95anything on the system. 96.Pp 97Almost all system objects are tagged with a single, active label element, 98reflecting the integrity of the object, or integrity of the data contained 99in the object. 100File system objects may contain an additional auxiliary label which 101determines the inherited integrity level for new files created in a 102directory or the alternate label assumed by the subject upon execution of 103an executable. 104In general, objects labels are represented in the following form: 105.Pp 106.Sm off 107.D1 Li lomac / Ar grade Bq Ar auxgrade 108.Sm on 109.Pp 110For example: 111.Pp 112.Bd -literal -offset indent 113lomac/10[2] 114lomac/low 115.Ed 116.Pp 117Subject labels consist of three label elements: a single (active) label, 118as well as a range of available labels. 119This range is represented using two ordered LOMAC label elements, and when set 120on a process, permits the process to change its active label to any label of 121greater or equal integrity to the low end of the range, and lesser or equal 122integrity to the high end of the range. 123In general, subject labels are represented in the following form: 124.Pp 125.Sm off 126.D1 Li lomac / Ar singlegrade ( lograde No - Ar higrade ) 127.Sm on 128.Pp 129Modification of objects is restricted to access via the following comparison: 130.Pp 131.D1 Ar subject Ns :: Ns Ar higrade No \[>=] Ar target-object Ns :: Ns Ar grade 132.Pp 133Modification of subjects is the same, as the target subject's single grade 134is the only element taken into comparison. 135.Pp 136Demotion of a subject occurs when the following comparison is true: 137.Pp 138.D1 Ar subject Ns :: Ns Ar singlegrade No > Ar object Ns :: Ns Ar grade 139.Pp 140When demotion occurs, the subject's 141.Ar singlegrade 142and 143.Ar higrade 144are reduced to the 145object's grade, as well as the 146.Ar lograde 147if necessary. 148When the demotion occurs, in addition to the permission of the subject being 149reduced, shared 150.Xr mmap 2 151objects which it has opened in its memory space may be revoked according to 152the following 153.Xr sysctl 3 154variables: 155.Pp 156.Bl -bullet -compact 157.It 158.Va security.mac.lomac.revocation_enabled 159.It 160.Va security.mac.enforce_vm 161.It 162.Va security.mac.mmap_revocation 163.It 164.Va security.mac.mmap_revocation_via_cow 165.El 166.Pp 167Upon execution of a file, if the executable has an auxiliary label, and that 168label is within the current range of 169.Ar lograde Ns - Ns Ar higrade , 170it will be assumed by the subject immediately. 171After this, demotion is performed just as with any other read operation, with 172the executable as the target. 173Through the use of auxiliary labels, programs may be initially executed 174at a lower effective integrity level, 175while retaining the ability to raise it again. 176.Pp 177These rules prevent subjects of lower integrity from influencing the 178behavior of higher integrity subjects by preventing the flow of information, 179and hence control, from allowing low integrity subjects to modify either 180a high integrity object or high integrity subjects acting on those objects. 181LOMAC integrity policies may be appropriate in a number of environments, 182both from the perspective of preventing corruption of the operating system, 183and corruption of user data if marked as higher integrity than the attacker. 184.Pp 185The LOMAC security model is quite similar to that of 186.Xr mac_biba 4 187and 188.Xr mac_mls 4 189in various ways. 190More background information on this can be found in their respective 191man pages. 192.Sh SEE ALSO 193.Xr mmap 2 , 194.Xr sysctl 3 , 195.Xr mac 4 , 196.Xr mac_biba 4 , 197.Xr mac_bsdextended 4 , 198.Xr mac_ifoff 4 , 199.Xr mac_mls 4 , 200.Xr mac_none 4 , 201.Xr mac_partition 4 , 202.Xr mac_portacl 4 , 203.Xr mac_seeotheruids 4 , 204.Xr mac_test 4 , 205.Xr mac 9 206.Sh HISTORY 207The 208.Nm 209policy module first appeared in 210.Fx 5.0 211and was developed by the 212.Tn TrustedBSD 213Project. 214.Sh AUTHORS 215This software was contributed to the 216.Fx 217Project by Network Associates Labs, 218the Security Research Division of Network Associates 219Inc. 220under DARPA/SPAWAR contract N66001-01-C-8035 221.Pq Dq CBOSS , 222as part of the DARPA CHATS research program. 223