MAC_BIBA(4) | Device Drivers Manual | MAC_BIBA(4) |
NAME¶
mac_biba
—
Biba data integrity policy
SYNOPSIS¶
To compile Biba into your kernel, place the following lines in your kernel configuration file:options MAC
options MAC_BIBA
options MAC
mac_biba_load="YES"
DESCRIPTION¶
Themac_biba
policy module implements the
Biba integrity model, which protects the integrity of system objects and
subjects by means of a strict information flow policy. In Biba, all system
subjects and objects are assigned integrity labels, made up of hierarchal
grades, and non-hierarchal components. Together, these label elements permit
all labels to be placed in a partial order, with information flow protections
based on a dominance operator describing the order. The hierarchal grade field
is expressed as a value between 0 and 65535, with higher values reflecting
higher integrity. The non-hierarchal compartment field is expressed as a set
of up to 256 components, numbered from 0 to 255. A complete label consists of
both hierarchal and non-hierarchal elements.
Three special label values exist:
Label | Comparison |
biba/low |
lower than all other labels |
biba/equal |
equal to all other labels |
biba/high |
higher than all other labels |
biba/high
” label is assigned to
system objects which affect the integrity of the system as a whole. The
“biba/equal
” label may be used to
indicate that a particular subject or object is exempt from the Biba
protections. These special label values are not specified as containing any
compartments, although in a label comparison,
“biba/high
” appears to contain all
compartments, “biba/equal
” the same
compartments as the other label to which it is being compared, and
“biba/low
” none.
In general, Biba access control takes the following model:
- A subject at the same integrity level as an object may both read from and write to the object as though Biba protections were not in place.
- A subject at a higher integrity level than an object may write to the object, but not read the object.
- A subject at a lower integrity level than an object may read the object, but not write to the object.
- If the subject and object labels may not be compared in the partial order, all access is restricted.
Label Format¶
Almost all system objects are tagged with an effective, active label element, reflecting the integrity of the object, or integrity of the data contained in the object. In general, objects labels are represented in the following form:biba/
grade:compartmentsbiba/10:2+3+6 biba/low
biba/
effectivegrade:effectivecompartments(lograde:locompartments-higrade:hicompartments)
For example:
biba/10:2+3+6(5:2+3-20:2+3+4+5+6) biba/high(low-high)
rangehigh
≥ effective
≥
rangelow
One class of objects with ranges currently exists, the network interface. In the
case of the network interface, the effective label element references the
default label for packets received over the interface, and the range
represents the range of acceptable labels of packets to be transmitted over
the interface.
Runtime Configuration¶
The following sysctl(8) MIBs are available for fine-tuning the enforcement of this MAC policy.- security.mac.biba.enabled
- Enables enforcement of the Biba integrity policy. (Default: 1).
- security.mac.biba.ptys_equal
- Label pty(4)s as
“
biba/equal
” upon creation. (Default: 0). - security.mac.biba.revocation_enabled
- Revoke access to objects if the label is changed to dominate the subject. (Default: 0).
SEE ALSO¶
mac(4), mac_bsdextended(4), mac_ifoff(4), mac_lomac(4), mac_mls(4), mac_none(4), mac_partition(4), mac_portacl(4), mac_seeotheruids(4), mac_test(4), maclabel(7), mac(9)HISTORY¶
Themac_biba
policy module first appeared in
FreeBSD 5.0 and was developed by the TrustedBSD
Project.
AUTHORS¶
This software was contributed to the FreeBSD Project by Network Associates Labs, the Security Research Division of Network Associates Inc. under DARPA/SPAWAR contract N66001-01-C-8035 (“CBOSS”), as part of the DARPA CHATS research program.November 18, 2002 | Debian |