16.9. MAC Policies with Labeling Features
前一頁 | 章 16. Mandatory Access Control | 下一頁

## 16.9. MAC Policies with Labeling Features

The next few sections will discuss MAC policies which use labels.

From here on this chapter will focus on the features of mac_biba(4), mac_lomac(4), mac_partition(4), and mac_mls(4).

### 注意:

This is an example configuration only and should not be considered for a production implementation. The goal is to document and show the syntax as well as examples for implementation and testing.

For these policies to work correctly several preparations must be made.

### 16.9.1. Preparation for Labeling Policies

The following changes are required in the `login.conf` file:

- An `insecure` class, or another class of similar type, must be added. The login class of `insecure` is not required and just used as an example here; different configurations may use another class name.

- The `insecure` class should have the following settings and definitions. Several of these can be altered but the line which defines the default label is a requirement and must remain.

  insecure:\ :copyright=/etc/COPYRIGHT:\ :welcome=/etc/motd:\ :setenv=MAIL=/var/mail/$,BLOCKSIZE=K:\ :path=~/bin:/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin:\ :manpath=/usr/share/man /usr/local/man:\ :nologin=/usr/sbin/nologin:\ :cputime=1h30m:\ :datasize=8M:\ :vmemoryuse=100M:\ :stacksize=2M:\ :memorylocked=4M:\ :memoryuse=8M:\ :filesize=8M:\ :coredumpsize=8M:\ :openfiles=24:\ :maxproc=32:\ :priority=0:\ :requirehome:\ :passwordtime=91d:\ :umask=022:\ :ignoretime@:\ :label=partition/13,mls/5,biba/low:

  The cap_mkdb(1) command needs to be ran on login.conf(5) before any of the users can be switched over to the new class.

  The `root` username should also be placed into a login class; otherwise, almost every command executed by `root` will require the use of `setpmac`.

  ### 警告:

  Rebuilding the `login.conf` database may cause some errors later with the daemon class. Simply uncommenting the daemon account and rebuilding the database should alleviate these issues.

- Ensure that all partitions on which MAC labeling will be implemented support the `multilabel`. We must do this because many of the examples here contain different labels for testing purposes. Review the output from the `mount` command as a precautionary measure.

- Switch any users who will have the higher security mechanisms enforced over to the new user class. A quick run of pw(8) or vipw(8) should do the trick.

前一頁 | 上一層 | 下一頁
16.8. The MAC portacl Module | 起始頁 | 16.10. The MAC partition Module

本文及其他文件，可由此下載： ftp://ftp.FreeBSD.org/pub/FreeBSD/doc/。

若有 FreeBSD 方面疑問，請先閱讀 FreeBSD 相關文件，如不能解決的話，再洽詢 <questions@FreeBSD.org>。
關於本文件的問題，請洽詢 <doc@FreeBSD.org>。