Requirements:
Requirements:
Technical contact: &a.rwatson;
++FreeBSD 5.0 was the first FreeBSD release to ship with support for Mandatory +Access Control (MAC), an access control technology allowing system +administrators to implement multi-level security, integrity protection, and +other "mandatory" policies. Policies may be compiled into the kernel, or +loaded as loadable kernel modules. +Later revisions of FreeBSD and the MAC Framework enhanced MAC support, +and additional policy modules were made available, such as a port of the +SELinux FLASK/TE framework available as a third party policy module. +However, many of the sample MAC modules included with FreeBSD are considered +experimental examples of what the technology can be used for, rather than +production policies. +For example, the Biba integrity policy can be deployed in production, but +requires significant tuning to do so effectively. +
++This task involves a general review of the MAC Framework and Policy modules, +with the goal of identifying improvement areas. It also involves specific +cleanups, optimizations, and completeness work on specific policy modules -- +most importantly, the Biba and MLS sample labeled policy modules. Work there +includes improving memory overhead and efficiency; for example, moving from +allocating complete labels for every labeled object to referencing common +label storage where labels are identical, which occurs a great deal of the +time in most systems. +Other cleanups include moving towards a canonical/extensible on-disk label +storage format, adding regression tests, investigating interactions with user +applications, and writing documentation. +
+Requirements:
+