Skip site navigation (1)Skip section navigation (2)

FreeBSD Manual Pages

  
 
  

home | help 
MAC_PARTITION(4)	    Kernel Interfaces Manual	      MAC_PARTITION(4)

NAME
       mac_partition --	process	partition policy

SYNOPSIS
       To  compile  the	 process  partition policy into	your kernel, place the
       following lines in your kernel configuration file:

	     options MAC
	     options MAC_PARTITION

       Alternately, to load the	process	partition module at boot  time,	 place
       the following line in your kernel configuration file:

	     options MAC

       and in loader.conf(5):

	     mac_partition_load="YES"

DESCRIPTION
       The  mac_partition policy module	implements a process partition policy,
       which  allows  administrators   to   place   running   processes	  into
       "partitions",  based  on	 their numeric process partition (specified in
       the process's MAC label).  Processes with  a  specified	partition  can
       only  see processes that	are in the same	partition.  If no partition is
       specified for a process,	it can see all other processes in  the	system
       (subject	 to  other  MAC	 policy	 restrictions  not defined in this man
       page).  No provisions for placing processes  into  multiple  partitions
       are available.

   Label Format
       Partition labels	take on	the following format:

	     partition/value

       Where value can be any integer value or "none".	For example:

	     partition/1
	     partition/20
	     partition/none

SEE ALSO
       mac(4),	 mac_biba(4),  mac_bsdextended(4),  mac_ddb(4),	 mac_ifoff(4),
       mac_lomac(4),	  mac_mls(4),	    mac_none(4),       mac_portacl(4),
       mac_seeotheruids(4), mac_test(4), maclabel(7), mac(9)

HISTORY
       The  mac_partition  policy module first appeared	in FreeBSD 5.0 and was
       developed by the	TrustedBSD Project.

AUTHORS
       This software was contributed to	the FreeBSD Project by	Network	 Asso-
       ciates  Labs, the Security Research Division of Network Associates Inc.
       under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of  the
       DARPA CHATS research program.

BUGS
       While  the  MAC Framework design	is intended to support the containment
       of the root user, not all attack	channels are  currently	 protected  by
       entry  point checks.  As	such, MAC Framework policies should not	be re-
       lied on,	in isolation, to protect against a malicious privileged	user.

FreeBSD	14.3			 July 25, 2015		      MAC_PARTITION(4)

Want to link to this manual page? Use this URL:
<https://man.freebsd.org/cgi/man.cgi?query=mac_partition&sektion=4&manpath=FreeBSD+14.3-RELEASE+and+Ports>

home | help