📄 mac-initial.html
字号:
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta name="generator" content="HTML Tidy, see www.w3.org" /><title>Explanation of MAC</title><meta name="GENERATOR" content="Modular DocBook HTML Stylesheet Version 1.7" /><link rel="HOME" title="FreeBSD 使用手册" href="index.html" /><link rel="UP" title="Mandatory Access Control" href="mac.html" /><link rel="PREVIOUS" title="Key Terms in this Chapter" href="mac-inline-glossary.html" /><link rel="NEXT" title="Understanding MAC Labels" href="mac-understandlabel.html" /><link rel="STYLESHEET" type="text/css" href="docbook.css" /><meta http-equiv="Content-Type" content="text/html; charset=GB2312" /></head><body class="SECT1" bgcolor="#FFFFFF" text="#000000" link="#0000FF" vlink="#840084"alink="#0000FF"><div class="NAVHEADER"><table summary="Header navigation table" width="100%" border="0" cellpadding="0"cellspacing="0"><tr><th colspan="3" align="center">FreeBSD 使用手册</th></tr><tr><td width="10%" align="left" valign="bottom"><a href="mac-inline-glossary.html"accesskey="P">后退</a></td><td width="80%" align="center" valign="bottom">章 15. Mandatory Access Control</td><td width="10%" align="right" valign="bottom"><a href="mac-understandlabel.html"accesskey="N">前进</a></td></tr></table><hr align="LEFT" width="100%" /></div><div class="SECT1"><h1 class="SECT1"><a id="MAC-INITIAL" name="MAC-INITIAL">15.3. Explanation ofMAC</a></h1><p>With all of these new terms in mind, consider how the <acronymclass="ACRONYM">MAC</acronym> framework augments the security of the system as a whole.The various policies provided by the <acronym class="ACRONYM">MAC</acronym> frameworkcould be used to protect the network and file systems, block users from accessing certainports and sockets, and more. Perhaps the best use of the policies is to blend themtogether, by loading several policy modules at a time, for a multi-layered securityenvironment. In a multi-layered security environment, multiple policies are in effect tokeep security in check. This is different then a hardening policy, which typicallyhardens elements of a system that is used only for specific purposes. The only downsideis administrative overhead in cases of multiple file system labels, setting networkaccess control user by user, etc.</p><p>These downsides are minimal when compared to the lasting effect of the framework; forinstance, the ability to pick choose which policies are required for a specificconfiguration keeps performance overhead down. The reduction of support for unneededpolicies can increase the overall performance of the system as well as offer flexibilityof choice. A good implementation would consider the overall security requirements andeffectively implement the various policies offered by the framework..</p><p>Thus a system utilizing <acronym class="ACRONYM">MAC</acronym> features should atleast guarantee that a user will not be permitted to change security attributes at will;all user utilities, programs and scripts must work within the constraints of the accessrules provided by the selected policies; and that total control of the <acronymclass="ACRONYM">MAC</acronym> access rules are in the hands of the systemadministrator.</p><p>It is the sole duty of the system administrator to carefully select the correctpolicies. Some environments may need to limit access control over the network; in thesecases, the <span class="CITEREFENTRY"><spanclass="REFENTRYTITLE">mac_portacl</span>(4)</span>, <span class="CITEREFENTRY"><spanclass="REFENTRYTITLE">mac_ifoff</span>(4)</span> and even <spanclass="CITEREFENTRY"><span class="REFENTRYTITLE">mac_biba</span>(4)</span> policies mightmake good starting points. In other cases, strict confidentiality of file system objectsmight be required. Policies such as <span class="CITEREFENTRY"><spanclass="REFENTRYTITLE">mac_bsdextended</span>(4)</span> and <spanclass="CITEREFENTRY"><span class="REFENTRYTITLE">mac_mls</span>(4)</span> exist for thispurpose.</p><p>Policy decisions could be made based on network configuration. Perhaps only certainusers should be permitted access to facilities provided by <spanclass="CITEREFENTRY"><span class="REFENTRYTITLE">ssh</span>(1)</span> to access thenetwork or the Internet. The <span class="CITEREFENTRY"><spanclass="REFENTRYTITLE">mac_portacl</span>(4)</span> would be the policy of choice forthese situations. But what should be done in the case of file systems? Should all accessto certain directories be severed from other groups or specific users? Or should we limituser or utility access to specific files by setting certain objects as classified?</p><p>In the file system case, access to objects might be considered confidential to someusers but not to others. For an example, a large development team might be broken offinto smaller groups of individuals. Developers in project A might not be permitted toaccess objects written by developers in project B. Yet they might need to access objectscreated by developers in project C; that is quite a situation indeed. Using the differentpolicies provided by the <acronym class="ACRONYM">MAC</acronym> framework; users could bedivided into these groups and then given access to the appropriate areas without the fearof information leakage.</p><p>Thus, each policy has a unique way of dealing with the overall security of a system.Policy selection should be based on a well thought out security policy. In many cases,the overall policy may need to be revised and reimplemented on the system. Understandingthe different policies offered by the <acronym class="ACRONYM">MAC</acronym> frameworkwill help administrators choose the best policies for their situations.</p><p>The default FreeBSD kernel does not include the option for the <acronymclass="ACRONYM">MAC</acronym> framework; thus the following kernel option must be addedbefore trying any of the examples or information in this chapter:</p><pre class="PROGRAMLISTING">options MAC</pre><p>And the kernel will require a rebuild and a reinstall.</p><div class="CAUTION"><blockquote class="CAUTION"><p><b>注意</b>While the various manual pages for <acronym class="ACRONYM">MAC</acronym>modules state that they may be built into the kernel, it is possible to lock the systemout of the network and more. Implementing <acronym class="ACRONYM">MAC</acronym> is muchlike implementing a firewall, but care must be taken to prevent being completely lockedout of the system. The ability to revert back to a previous configuration should beconsidered while the implementation of <acronym class="ACRONYM">MAC</acronym> remotelyshould be done with extreme caution.</p></blockquote></div></div><div class="NAVFOOTER"><hr align="LEFT" width="100%" /><table summary="Footer navigation table" width="100%" border="0" cellpadding="0"cellspacing="0"><tr><td width="33%" align="left" valign="top"><a href="mac-inline-glossary.html"accesskey="P">后退</a></td><td width="34%" align="center" valign="top"><a href="index.html"accesskey="H">起点</a></td><td width="33%" align="right" valign="top"><a href="mac-understandlabel.html"accesskey="N">前进</a></td></tr><tr><td width="33%" align="left" valign="top">Key Terms in this Chapter</td><td width="34%" align="center" valign="top"><a href="mac.html"accesskey="U">上一级</a></td><td width="33%" align="right" valign="top">Understanding MAC Labels</td></tr></table></div></body></html>⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -