Skip site navigation (1)Skip section navigation (2)

FreeBSD Manual Pages


home | help
MAC_BIBA(4)		 BSD Kernel Interfaces Manual		   MAC_BIBA(4)

     mac_biba -- Biba data integrity policy

     To	compile	Biba into your kernel, place the following lines in your ker-
     nel configuration file:

	   options MAC
	   options MAC_BIBA

     Alternately, to load the Biba module at boot time,	place the following
     line in your kernel configuration file:

	   options MAC

     and in loader.conf(5):


     The mac_biba policy module	implements the Biba integrity model, which
     protects the integrity of system objects and subjects by means of a
     strict information	flow policy.  In Biba, all system subjects and objects
     are assigned integrity labels, made up of hierarchal grades, and non-hi-
     erarchal components.  Together, these label elements permit all labels to
     be	placed in a partial order, with	information flow protections based on
     a dominance operator describing the order.	 The hierarchal	grade field is
     expressed as a value between 0 and	65535, with higher values reflecting
     higher integrity.	The non-hierarchal compartment field is	expressed as a
     set of up to 256 components, numbered from	0 to 255.  A complete label
     consists of both hierarchal and non-hierarchal elements.

     Three special label values	exist:

	   Label	 Comparison
	   biba/low	 lower than all	other labels
	   biba/equal	 equal to all other labels
	   biba/high	 higher	than all other labels

     The "biba/high" label is assigned to system objects which affect the in-
     tegrity of	the system as a	whole.	The "biba/equal" label may be used to
     indicate that a particular	subject	or object is exempt from the Biba pro-
     tections.	These special label values are not specified as	containing any
     compartments, although in a label comparison, "biba/high" appears to con-
     tain all compartments, "biba/equal" the same compartments as the other
     label to which it is being	compared, and "biba/low" none.

     In	general, Biba access control takes the following model:

     +o	 A subject at the same integrity level as an object may	both read from
	 and write to the object as though Biba	protections were not in	place.

     +o	 A subject at a	higher integrity level than an object may write	to the
	 object, but not read the object.

     +o	 A subject at a	lower integrity	level than an object may read the ob-
	 ject, but not write to	the object.

     +o	 If the	subject	and object labels may not be compared in the partial
	 order,	all access is restricted.

     These rules prevent subjects of lower integrity from influencing the be-
     havior of higher integrity	subjects by preventing the flow	of informa-
     tion, and hence control, from allowing low	integrity subjects to modify
     either a high integrity object or high integrity subjects acting on those
     objects.  Biba integrity policies may be appropriate in a number of envi-
     ronments, both from the perspective of preventing corruption of the oper-
     ating system, and corruption of user data if marked as higher integrity
     than the attacker.	 In traditional	trusted	operating systems, the Biba
     integrity model is	used to	protect	the Trusted Code Base (TCB).

     The Biba integrity	model is similar to lomac(4), with the exception that
     LOMAC permits access by a higher integrity	subject	to a lower integrity
     object, but downgrades the	integrity level	of the subject to prevent in-
     tegrity rules from	being violated.	 Biba is a fixed label policy in that
     all subject and object label changes are explicit,	whereas	LOMAC is a
     floating label policy.

     The Biba integrity	model is also similar to mac_mls(4), with the excep-
     tion that the dominance operator and access rules are reversed, prevent-
     ing the downward flow of information rather than the upward flow of in-
     formation.	 Multi-Level Security (MLS) protects the confidentiality,
     rather than the integrity,	of subjects and	objects.

   Label Format
     Almost all	system objects are tagged with a single, active	label element,
     reflecting	the integrity of the object, or	integrity of the data con-
     tained in the object.  In general,	objects	labels are represented in the
     following form:


     For example:


     Subject labels consist of three label elements: a single (active) label,
     as	well as	a range	of available labels.  This range is represented	using
     two ordered Biba label elements, and when set on a	process, permits the
     process to	change its active label	to any label of	greater	or equal in-
     tegrity to	the low	end of the range, and lesser or	equal integrity	to the
     high end of the range.  In	general, subject labels	are represented	in the
     following form:


     For example:


     Valid ranged labels must meet the following requirement regarding their

	   rangehigh >=	single >= rangelow

     One class of objects with ranges currently	exists,	the network interface.
     In	the case of the	network	interface, the single label element references
     the default label for packets received over the interface,	and the	range
     represents	the range of acceptable	labels of packets to be	transmitted
     over the interface.

   Runtime Configuration
     The following sysctl(8) MIBs are available	for fine-tuning	the enforce-
     ment of this MAC policy.

     security.mac.biba.enabled	   Enables enforcement of the Biba integrity
				   policy.  (Default: 1).

     security.mac.biba.ptys_equal  Label pty(4)s as "biba/equal" upon cre-
				   ation.  (Default: 0).

				   Revoke access to objects if the label is
				   changed to dominate the subject.  (Default:

     lomac(4), mac(4), mac_bsdextended(4), mac_ifoff(4), mac_lomac(4),
     mac_mls(4), mac_none(4), mac_partition(4),	mac_portacl(4),
     mac_seeotheruids(4), mac_test(4), maclabel(7), mac(9)

     The mac_biba policy module	first appeared in FreeBSD 5.0 and was devel-
     oped by the TrustedBSD Project.

     This software was contributed to the FreeBSD Project by Network Asso-
     ciates Labs, the Security Research	Division of Network Associates Inc.
     under DARPA/SPAWAR	contract N66001-01-C-8035 ("CBOSS"), as	part of	the
     DARPA CHATS research program.

BSD			       November	18, 2002			   BSD


Want to link to this manual page? Use this URL:

home | help