*nix Documentation Project
·  Home
 +   man pages
·  Linux HOWTOs
·  FreeBSD Tips
·  *niX Forums

  man pages->FreeBSD man pages -> mac_biba (4)              



NAME    [Toc]    [Back]

     mac_biba -- Biba data integrity policy

SYNOPSIS    [Toc]    [Back]

     To compile Biba into your kernel, place the following lines in your kernel
 configuration file:

	   options MAC
	   options MAC_BIBA

     Alternately, to load the Biba module at boot time, place the following
     line in your kernel configuration file:

	   options MAC

     and in loader.conf(5):


DESCRIPTION    [Toc]    [Back]

     The mac_biba policy module implements the Biba integrity model, which
     protects the integrity of system objects and subjects by means of a
     strict information flow policy.  In Biba, all system subjects and objects
     are assigned integrity labels, made up of hierarchal grades, and nonhierarchal
 components.  Together, these label elements permit all labels
     to be placed in a partial order, with information flow protections based
     on a dominance operator describing the order.  The hierarchal grade field
     is expressed as a value between 0 and 65535, with higher values reflecting
 higher integrity.  The non-hierarchal compartment field is expressed
     as a set of up to 256 components, numbered from 0 to 255.	A complete
     label consists of both hierarchal and non-hierarchal elements.

     Three special label values exist:

	   Label	 Comparison
	   biba/low	 lower than all other labels
	   biba/equal	 equal to all other labels
	   biba/high	 higher than all other labels

     The ``biba/high'' label is assigned to system objects which affect the
     integrity of the system as a whole.  The ``biba/equal'' label may be used
     to indicate that a particular subject or object is exempt from the Biba
     protections.  These special label values are not specified as containing
     any compartments, although in a label comparison, ``biba/high'' appears
     to contain all compartments, ``biba/equal'' the same compartments as the
     other label to which it is being compared, and ``biba/low'' none.

     In general, Biba access control takes the following model:

     +o	 A subject at the same integrity level as an object may both read from
	 and write to the object as though Biba protections were not in place.

     +o	 A subject at a higher integrity level than an object may write to the
	 object, but not read the object.

     +o	 A subject at a lower integrity level than an object may read the
	 object, but not write to the object.

     +o	 If the subject and object labels may not be compared in the partial
	 order, all access is restricted.

     These rules prevent subjects of lower integrity from influencing the
     behavior of higher integrity subjects by preventing the flow of information,
 and hence control, from allowing low integrity subjects to modify
     either a high integrity object or high integrity subjects acting on those
     objects.  Biba integrity policies may be appropriate in a number of environments,
 both from the perspective of preventing corruption of the operating
 system, and corruption of user data if marked as higher integrity
     than the attacker.  In traditional trusted operating systems, the Biba
     integrity model is used to protect the Trusted Code Base (TCB).

     The Biba integrity model is similar to lomac(4), with the exception that
     LOMAC permits access by a higher integrity subject to a lower integrity
     object, but downgrades the integrity level of the subject to prevent
     integrity rules from being violated.  Biba is a fixed label policy in
     that all subject and object label changes are explicit, whereas LOMAC is
     a floating label policy.

     The Biba integrity model is also similar to mac_mls(4), with the exception
 that the dominance operator and access rules are reversed, preventing
 the downward flow of information rather than the upward flow of
     information.  Multi-Level Security (MLS) protects the confidentiality,
     rather than the integrity, of subjects and objects.

   Label Format    [Toc]    [Back]
     Almost all system objects are tagged with a single, active label element,
     reflecting the integrity of the object, or integrity of the data contained
 in the object.  In general, objects labels are represented in the
     following form:


     For example:


     Subject labels consist of three label elements: a single (active) label,
     as well as a range of available labels.  This range is represented using
     two ordered Biba label elements, and when set on a process, permits the
     process to change its active label to any label of greater or equal
     integrity to the low end of the range, and lesser or equal integrity to
     the high end of the range.  In general, subject labels are represented in
     the following form:


     For example:


     Valid ranged labels must meet the following requirement regarding their

	   rangehigh >= single >= rangelow

     One class of objects with ranges currently exists, the network interface.
     In the case of the network interface, the single label element references
     the default label for packets received over the interface, and the range
     represents the range of acceptable labels of packets to be transmitted
     over the interface.

   Runtime Configuration    [Toc]    [Back]
     The following sysctl(8) MIBs are available for fine-tuning the enforcement
 of this MAC policy.

     security.mac.biba.enabled	   Enables enforcement of the Biba integrity
				   policy.  (Default: 1).

     security.mac.biba.ptys_equal  Label pty(4)s as ``biba/equal'' upon creation.
  (Default: 0).

				   Revoke access to objects if the label is
				   changed to dominate the subject.  (Default:

SEE ALSO    [Toc]    [Back]

     lomac(4), mac(4), mac_bsdextended(4), mac_ifoff(4), mac_lomac(4),
     mac_mls(4), mac_none(4), mac_partition(4), mac_portacl(4),
     mac_seeotheruids(4), mac_test(4), maclabel(7), mac(9)

HISTORY    [Toc]    [Back]

     The mac_biba policy module first appeared in FreeBSD 5.0 and was developed
 by the TrustedBSD Project.

AUTHORS    [Toc]    [Back]

     This software was contributed to the FreeBSD Project by Network Associates
 Labs, the Security Research Division of Network Associates Inc.
     under DARPA/SPAWAR contract N66001-01-C-8035 (``CBOSS''), as part of the
     DARPA CHATS research program.

FreeBSD 5.2.1		       November 18, 2002		 FreeBSD 5.2.1
[ Back ]
 Similar pages
Name OS Title
mac_lomac FreeBSD Low-watermark Mandatory Access Control data integrity policy
fsck_cachefs HP-UX check integrity of data cached with CacheFS
EvmEventValidate Tru64 Performs a data integrity check on an event.
gss_verify_mic HP-UX check a cryptographic message integrity code (MIC) against a message to verify its integrity
pwck Linux verify integrity of password files
grpck Linux verify integrity of group files
cr_verify HP-UX verify integrity of crash dump
syncer HP-UX periodically sync for file system integrity
mac_from_msen IRIX convert independent sensitivity or integrity labels to mac_t
CSSM_TP_CrlVerify Tru64 Verify integrity of the certificate revocation list (CDSA)
Copyright © 2004-2005 DeniX Solutions SRL
newsletter delivery service