Provided by: freebsd-manpages_7.1~beta1-1_all bug

NAME

     mac_biba - Biba data integrity policy

SYNOPSIS

     To compile Biba into your kernel, place the following lines in your
     kernel configuration file:

           options MAC
           options MAC_BIBA

     Alternately, to load the Biba module at boot time, place the following
     line in your kernel configuration file:

           options MAC

     and in loader.conf(5):

           mac_biba_load="YES"

DESCRIPTION

     The mac_biba policy module implements the Biba integrity model, which
     protects the integrity of system objects and subjects by means of a
     strict information flow policy.  In Biba, all system subjects and objects
     are assigned integrity labels, made up of hierarchal grades, and non-
     hierarchal components.  Together, these label elements permit all labels
     to be placed in a partial order, with information flow protections based
     on a dominance operator describing the order.  The hierarchal grade field
     is expressed as a value between 0 and 65535, with higher values
     reflecting higher integrity.  The non-hierarchal compartment field is
     expressed as a set of up to 256 components, numbered from 0 to 255.  A
     complete label consists of both hierarchal and non-hierarchal elements.

     Three special label values exist:

           Label         Comparison
           biba/low      lower than all other labels
           biba/equal    equal to all other labels
           biba/high     higher than all other labels

     The “biba/high” label is assigned to system objects which affect the
     integrity of the system as a whole.  The “biba/equal” label may be used
     to indicate that a particular subject or object is exempt from the Biba
     protections.  These special label values are not specified as containing
     any compartments, although in a label comparison, “biba/high” appears to
     contain all compartments, “biba/equal” the same compartments as the other
     label to which it is being compared, and “biba/low” none.

     In general, Biba access control takes the following model:

     ·   A subject at the same integrity level as an object may both read from
         and write to the object as though Biba protections were not in place.

     ·   A subject at a higher integrity level than an object may write to the
         object, but not read the object.

     ·   A subject at a lower integrity level than an object may read the
         object, but not write to the object.

     ·   If the subject and object labels may not be compared in the partial
         order, all access is restricted.

     These rules prevent subjects of lower integrity from influencing the
     behavior of higher integrity subjects by preventing the flow of
     information, and hence control, from allowing low integrity subjects to
     modify either a high integrity object or high integrity subjects acting
     on those objects.  Biba integrity policies may be appropriate in a number
     of environments, both from the perspective of preventing corruption of
     the operating system, and corruption of user data if marked as higher
     integrity than the attacker.  In traditional trusted operating systems,
     the Biba integrity model is used to protect the Trusted Code Base (TCB).

     The Biba integrity model is similar to mac_lomac(4), with the exception
     that LOMAC permits access by a higher integrity subject to a lower
     integrity object, but downgrades the integrity level of the subject to
     prevent integrity rules from being violated.  Biba is a fixed label
     policy in that all subject and object label changes are explicit, whereas
     LOMAC is a floating label policy.

     The Biba integrity model is also similar to mac_mls(4), with the
     exception that the dominance operator and access rules are reversed,
     preventing the downward flow of information rather than the upward flow
     of information.  Multi-Level Security (MLS) protects the confidentiality,
     rather than the integrity, of subjects and objects.

   Label Format
     Almost all system objects are tagged with an effective, active label
     element, reflecting the integrity of the object, or integrity of the data
     contained in the object.  In general, objects labels are represented in
     the following form:

           biba/grade:compartments

     For example:

           biba/10:2+3+6
           biba/low

     Subject labels consist of three label elements: an effective (active)
     label, as well as a range of available labels.  This range is represented
     using two ordered Biba label elements, and when set on a process, permits
     the process to change its active label to any label of greater or equal
     integrity to the low end of the range, and lesser or equal integrity to
     the high end of the range.  In general, subject labels are represented in
     the following form:

           biba/effectivegrade:effectivecompartments(lograde:locompartments-
           higrade:hicompartments)

     For example:

           biba/10:2+3+6(5:2+3-20:2+3+4+5+6)
           biba/high(low-high)

     Valid ranged labels must meet the following requirement regarding their
     elements:

           rangehigheffectiverangelow

     One class of objects with ranges currently exists, the network interface.
     In the case of the network interface, the effective label element
     references the default label for packets received over the interface, and
     the range represents the range of acceptable labels of packets to be
     transmitted over the interface.

   Runtime Configuration
     The following sysctl(8) MIBs are available for fine-tuning the
     enforcement of this MAC policy.

     security.mac.biba.enabled     Enables enforcement of the Biba integrity
                                   policy.  (Default: 1).

     security.mac.biba.ptys_equal  Label pty(4)s as “biba/equal” upon
                                   creation.  (Default: 0).

     security.mac.biba.revocation_enabled
                                   Revoke access to objects if the label is
                                   changed to dominate the subject.  (Default:
                                   0).

SEE ALSO

     mac(4), mac_bsdextended(4), mac_ifoff(4), mac_lomac(4), mac_mls(4),
     mac_none(4), mac_partition(4), mac_portacl(4), mac_seeotheruids(4),
     mac_test(4), maclabel(7), mac(9)

HISTORY

     The mac_biba policy module first appeared in FreeBSD 5.0 and was
     developed by the TrustedBSD Project.

AUTHORS

     This software was contributed to the FreeBSD Project by Network
     Associates Labs, the Security Research Division of Network Associates
     Inc.  under DARPA/SPAWAR contract N66001-01-C-8035 (“CBOSS”), as part of
     the DARPA CHATS research program.