diff --git a/en_US.ISO8859-1/books/handbook/mac/chapter.sgml b/en_US.ISO8859-1/books/handbook/mac/chapter.sgml index 67bf7575a6..b6ea560750 100644 --- a/en_US.ISO8859-1/books/handbook/mac/chapter.sgml +++ b/en_US.ISO8859-1/books/handbook/mac/chapter.sgml @@ -331,7 +331,7 @@ the system. When setting a label, the user must be able to comprehend - what it is, exactly, that they are doing. Setting the label + what it is, exactly, that is being done. Setting the label too high or too low may jeopardize the entire security structure of their directory or file system. @@ -393,7 +393,7 @@ Label Configuration Virtually all aspects of label policy configuration - will be performed using a set of four commands. Theses + will be performed using a set of four commands. These commands provide a simple interface for object or subject configuration or the manipulation and verification of the configuration. @@ -412,8 +412,8 @@ quiescent is when an error occurred. In some cases this error may be a Permission denied and is usually obtained when the label is being set or modified - on an object which is restricted. The system administrator, - may use the commands in conjunction to overcome this: + on an object which is restricted. The system administrator + may use the following commands to overcome this: &prompt.root; setfmac biba/high test Permission denied @@ -422,15 +422,15 @@ test: biba/high As can be observed, the setpmac - can be used to override the policies settings by assigning + can be used to override the policy's settings by assigning a different label to the invoked process. The - getpmac is usually used with current - running processes, such as sendmail + getpmac is usually used with currently + running processes, such as sendmail: although it takes a process ID in place of a command the logic is extremely similar. It should be pointed out that users will only be able to override policy labels if - they themselves own the object or subject. If a user would - attempt to manipulate a file not in their access level, the + they themselves own the object or subject. If users would + attempt to manipulate a file not in their access levels, the Operation not permitted error will be displayed by the mac_set_link function. @@ -441,7 +441,7 @@ test: biba/high Users themselves are required to have labels so that their files and processes may properly. This is configured through the login.conf file - by use of login classes. Every policy which uses labels + by use of login classes. Every policy that uses labels will enforce the user class setting. An example entry containing every policy is listed @@ -475,7 +475,7 @@ test: biba/high user class default label which will be enforced by MAC. Users will never be permitted to modify this value, thus it can be considered not optional - in the user case. In a real configuration; however, the + in the user case. In a real configuration, however, the administrator will never wish to enable every policy. It is recommended that the rest of this chapter be reviewed before any of this configuration is implemented. @@ -487,7 +487,7 @@ test: biba/high example or discussion. It is useful to note that many sites may have a - particularly large amount of users requiring several + particularly large number of users requiring several different user classes. In depth planning is required as this may get extremely difficult to manage. @@ -517,7 +517,7 @@ test: biba/high Each policy which supports labeling has some tunable which may be used to disable the MAC - label on network interfaces. Setting them to + label on network interfaces. Setting the label to will have a similar effect. Review the output from sysctl, the policy manual pages, or even the information found later in this chapter @@ -563,8 +563,8 @@ test: biba/high - This machine only requires one label - biba/high for everything in the system. + This machine only requires one label, + biba/high, for everything in the system. Here the file system would not require the option as a single label will always be in effect. @@ -680,7 +680,7 @@ test: biba/high Every policy or MAC option supports - a tunables. These usually hang off of the + tunables. These usually hang off of the security.mac.<policyname> tree. To view all of the tunables from MAC use the following command: @@ -1347,8 +1347,8 @@ test: biba/high security.mac.mls.max_compartments is - used to set the maximum amount of compartment levels with - objects; basically the maximum compartment amount allowed + used to set the maximum number of compartment levels with + objects; basically the maximum compartment number allowed on a system.