os/doc
3
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

Wrap paragraphs.

Browse source
This commit is contained in:
Chris Costello 2002-12-10 00:24:38 +00:00
parent ecd32ee9b9
commit 94507d9438
Notes: svn2git 2020-12-08 03:00:23 +00:00 
svn path=/head/; revision=15267
1 changed files with 43 additions and 43 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

76
en_US.ISO8859-1/books/handbook/security/chapter.sgml
View file

@ -3567,13 +3567,14 @@ user@unfirewalled.myserver.com's password: <userinput>*******</userinput></scree
<para>When configured into a kernel, the MAC Framework permits
security modules to augment the existing kernel access control
model, restricting access to system services and objects. For
example, the &man.mac.bsdextended.4; module augments file system access
control, permitting administrators to provide a firewall-like
ruleset constraining access to file system objects based on user
ids and group membership. Some modules require little or no
configuration, such as &man.mac.seeotheruids.4, whereas others perform
ubiquitous object labeling, such as &man.mac.biba.4; and &man.mac.mls.4;, and
require extensive configuration.</para>
example, the &man.mac.bsdextended.4; module augments file system
access control, permitting administrators to provide a
firewall-like ruleset constraining access to file system objects
based on user ids and group membership. Some modules require
little or no configuration, such as &man.mac.seeotheruids.4,
whereas others perform ubiquitous object labeling, such as
&man.mac.biba.4; and &man.mac.mls.4;, and require extensive
configuration.</para>
<para>To enable the MAC Framework in your system kernel, you must
add the following entry to your kernel configuration:</para>
@ -3588,11 +3589,11 @@ user@unfirewalled.myserver.com's password: <userinput>*******</userinput></scree
<para>Different MAC policies may be configured in different ways;
frequently, MAC policy modules export configuration parameters
using the &man.sysctl.8; <acronym>MIB</acronym> using the
<varname>security.mac</varname> namespace. Policies relying on file system
or other labels may require a configuration step that involes
assigning initial labels to system objects or creating a
policy configuration file. For information on how to configure
and use each policy module, see its man page.</para>
<varname>security.mac</varname> namespace. Policies relying on
file system or other labels may require a configuration step
that involes assigning initial labels to system objects or
creating a policy configuration file. For information on how to
configure and use each policy module, see its man page.</para>
<para>A variety of tools are available to configure the MAC Framework
and labels maintained by various policies. Extensions have been
@ -3712,22 +3713,20 @@ user@unfirewalled.myserver.com's password: <userinput>*******</userinput></scree
<para>Module name: mac_mls.ko</para>
<para>Kernel option: <literal>MAC_MLS</literal></para>
<para>Multi-Level Security (<acronym>MLS</acronym>)
(&man.mac.mls.4;) provides for hierarchal and
non-hierarchal labeling of all system objects with
sensitivity data, and the strict enforcement of an
information flow policy to prevent the leakage of
confidential data to untrusted parties. The logical
conjugate of the Biba Integrity Policy,
<acronym>MLS</acronym> is frequently shipped in
commercial trusted operating systems to protect data
secrecy in multi-user environments. Hierarchal labels
provide support for the notion of clearances and
classifications in traditional parlance; non-hierarchal
labels provide support for <quote>need-to-know.</quote> As with
Biba, ubiquitous labeling of objects occurs, and it
must therefore be compiled into the kernel or loaded
at boot. As with Biba, extensive initial configuration
may be required.</para>
(&man.mac.mls.4;) provides for hierarchal and non-hierarchal
labeling of all system objects with sensitivity data, and the
strict enforcement of an information flow policy to prevent
the leakage of confidential data to untrusted parties. The
logical conjugate of the Biba Integrity Policy,
<acronym>MLS</acronym> is frequently shipped in commercial
trusted operating systems to protect data secrecy in
multi-user environments. Hierarchal labels provide support
for the notion of clearances and classifications in
traditional parlance; non-hierarchal labels provide support
for <quote>need-to-know.</quote> As with Biba, ubiquitous
labeling of objects occurs, and it must therefore be compiled
into the kernel or loaded at boot. As with Biba, extensive
initial configuration may be required.</para>
</sect2>
<sect2 id="mac-policy-none">
<title>MAC Stub Policy (mac_none)</title>
@ -3768,14 +3767,15 @@ user@unfirewalled.myserver.com's password: <userinput>*******</userinput></scree
<para>Vendor: TrustedBSD Project</para>
<para>Module name: mac_seeotheruids.ko</para>
<para>Kernel option: <literal>MAC_SEEOTHERUIDS</literal></para>
<para>The See Other Uids policy (&man.mac.seeotheruids.4;) implements
a similar process visibility model to mac_partition,
except that it relies on process credentials to control
visibility of processes, rather than partition labels. This
policy may be configured to exempt certain users and groups,
including permitting system operators to view all processes
without special privilege. This policy may be compiled into
the kernel, loaded at boot, or loaded at run-time.</para>
<para>The See Other Uids policy (&man.mac.seeotheruids.4;)
implements a similar process visibility model to
mac_partition, except that it relies on process credentials to
control visibility of processes, rather than partition labels.
This policy may be configured to exempt certain users and
groups, including permitting system operators to view all
processes without special privilege. This policy may be
compiled into the kernel, loaded at boot, or loaded at
run-time.</para>
</sect2>
<sect2 id="mac-policy-test">
<title>MAC Framework Test Policy (mac_test)</title>
@ -3785,8 +3785,8 @@ user@unfirewalled.myserver.com's password: <userinput>*******</userinput></scree
<para>Vendor: TrustedBSD Project</para>
<para>Module name: mac_test.ko</para>
<para>Kernel option: <literal>MAC_TEST</literal></para>
<para>The Test policy (&man.mac.test.4;) provides a regression test
environment for the MAC Framework, and will cause a
<para>The Test policy (&man.mac.test.4;) provides a regression
test environment for the MAC Framework, and will cause a
fail-stop in the event that internal MAC Framework assertions
about proper data labeling fail. This module can be used to
detect failures to properly label system objects in the kernel