FreeBSD Manual Pages
MAC_BIBA(4) Kernel Interfaces Manual MAC_BIBA(4) NAME mac_biba -- Biba data integrity policy SYNOPSIS To compile Biba into your kernel, place the following lines in your kernel configuration file: options MAC options MAC_BIBA Alternately, to load the Biba module at boot time, place the following line in your kernel configuration file: options MAC and in loader.conf(5): mac_biba_load="YES" DESCRIPTION The mac_biba policy module implements the Biba integrity model, which protects the integrity of system objects and subjects by means of a strict information flow policy. In Biba, all system subjects and ob- jects are assigned integrity labels, made up of hierarchal grades, and non-hierarchal components. Together, these label elements permit all labels to be placed in a partial order, with information flow protec- tions based on a dominance operator describing the order. The hierar- chal grade field is expressed as a value between 0 and 65535, with higher values reflecting higher integrity. The non-hierarchal compart- ment field is expressed as a set of up to 256 components, numbered from 0 to 255. A complete label consists of both hierarchal and non-hierar- chal elements. Three special label values exist: Label Comparison biba/low lower than all other labels biba/equal equal to all other labels biba/high higher than all other labels The "biba/high" label is assigned to system objects which affect the integrity of the system as a whole. The "biba/equal" label may be used to indicate that a particular subject or object is exempt from the Biba protections. These special label values are not specified as contain- ing any compartments, although in a label comparison, "biba/high" ap- pears to contain all compartments, "biba/equal" the same compartments as the other label to which it is being compared, and "biba/low" none. In general, Biba access control takes the following model: o A subject at the same integrity level as an object may both read from and write to the object as though Biba protections were not in place. o A subject at a higher integrity level than an object may write to the object, but not read the object. o A subject at a lower integrity level than an object may read the object, but not write to the object. o If the subject and object labels may not be compared in the partial order, all access is restricted. These rules prevent subjects of lower integrity from influencing the behavior of higher integrity subjects by preventing the flow of infor- mation, and hence control, from allowing low integrity subjects to mod- ify either a high integrity object or high integrity subjects acting on those objects. Biba integrity policies may be appropriate in a number of environments, both from the perspective of preventing corruption of the operating system, and corruption of user data if marked as higher integrity than the attacker. In traditional trusted operating systems, the Biba integrity model is used to protect the Trusted Code Base (TCB). The Biba integrity model is similar to mac_lomac(4), with the exception that LOMAC permits access by a higher integrity subject to a lower in- tegrity object, but downgrades the integrity level of the subject to prevent integrity rules from being violated. Biba is a fixed label policy in that all subject and object label changes are explicit, whereas LOMAC is a floating label policy. The Biba integrity model is also similar to mac_mls(4), with the excep- tion that the dominance operator and access rules are reversed, pre- venting the downward flow of information rather than the upward flow of information. Multi-Level Security (MLS) protects the confidentiality, rather than the integrity, of subjects and objects. Label Format Almost all system objects are tagged with an effective, active label element, reflecting the integrity of the object, or integrity of the data contained in the object. In general, objects labels are repre- sented in the following form: biba/grade:compartments For example: biba/10:2+3+6 biba/low Subject labels consist of three label elements: an effective (active) label, as well as a range of available labels. This range is repre- sented using two ordered Biba label elements, and when set on a process, permits the process to change its active label to any label of greater or equal integrity to the low end of the range, and lesser or equal integrity to the high end of the range. In general, subject la- bels are represented in the following form: biba/effectivegrade:effectivecompartments(lograde:locompartments- higrade:hicompartments) For example: biba/10:2+3+6(5:2+3-20:2+3+4+5+6) biba/high(low-high) Valid ranged labels must meet the following requirement regarding their elements: rangehigh >= effective >= rangelow One class of objects with ranges currently exists, the network inter- face. In the case of the network interface, the effective label ele- ment references the default label for packets received over the inter- face, and the range represents the range of acceptable labels of pack- ets to be transmitted over the interface. Runtime Configuration The following sysctl(8) MIBs are available for fine-tuning the enforce- ment of this MAC policy. security.mac.biba.enabled Enables enforcement of the Biba integrity policy. (Default: 1). security.mac.biba.ptys_equal Label pty(4)s as "biba/equal" upon cre- ation. (Default: 0). security.mac.biba.revocation_enabled Revoke access to objects if the label is changed to dominate the subject. (De- fault: 0). SEE ALSO mac(4), mac_bsdextended(4), mac_ifoff(4), mac_lomac(4), mac_mls(4), mac_none(4), mac_partition(4), mac_portacl(4), mac_seeotheruids(4), mac_test(4), maclabel(7), mac(9) HISTORY The mac_biba policy module first appeared in FreeBSD 5.0 and was devel- oped by the TrustedBSD Project. AUTHORS This software was contributed to the FreeBSD Project by Network Asso- ciates Labs, the Security Research Division of Network Associates Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA CHATS research program. FreeBSD 13.2 November 18, 2002 MAC_BIBA(4)
NAME | SYNOPSIS | DESCRIPTION | SEE ALSO | HISTORY | AUTHORS
Want to link to this manual page? Use this URL:
<https://man.freebsd.org/cgi/man.cgi?query=mac_biba&manpath=FreeBSD+14.0-RELEASE+and+Ports>