📄 mac-initial.html
字号:
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta name="generator" content="HTML Tidy, see www.w3.org" /><title>Explanation of MAC</title><meta name="GENERATOR" content="Modular DocBook HTML Stylesheet Version 1.7" /><link rel="HOME" title="FreeBSD Handbook" href="index.html" /><link rel="UP" title="Mandatory Access Control" href="mac.html" /><link rel="PREVIOUS" title="Key Terms in this Chapter" href="mac-inline-glossary.html" /><link rel="NEXT" title="Understanding MAC Labels" href="mac-understandlabel.html" /><link rel="STYLESHEET" type="text/css" href="docbook.css" /></head><body class="SECT1" bgcolor="#FFFFFF" text="#000000" link="#0000FF" vlink="#840084"alink="#0000FF"><div class="NAVHEADER"><table summary="Header navigation table" width="100%" border="0" cellpadding="0"cellspacing="0"><tr><th colspan="3" align="center">FreeBSD Handbook</th></tr><tr><td width="10%" align="left" valign="bottom"><a href="mac-inline-glossary.html"accesskey="P">Prev</a></td><td width="80%" align="center" valign="bottom">Chapter 15 Mandatory Access Control</td><td width="10%" align="right" valign="bottom"><a href="mac-understandlabel.html"accesskey="N">Next</a></td></tr></table><hr align="LEFT" width="100%" /></div><div class="SECT1"><h1 class="SECT1"><a id="MAC-INITIAL" name="MAC-INITIAL">15.3 Explanation of MAC</a></h1><p>With all of these new terms in mind, consider how the <acronymclass="ACRONYM">MAC</acronym> framework augments the security of the system as a whole.The various security policies provided by the <acronym class="ACRONYM">MAC</acronym>framework could be used to protect the network and file systems, block users fromaccessing certain ports and sockets, and more. Perhaps the best use of the policies is toblend them together, by loading several security policy modules at a time, for amulti-layered security environment. In a multi-layered security environment, multiplepolicies are in effect to keep security in check. This is different then a hardeningpolicy, which typically hardens elements of a system that is used only for specificpurposes. The only downside is administrative overhead in cases of multiple file systemlabels, setting network access control user by user, etc.</p><p>These downsides are minimal when compared to the lasting effect of the framework; forinstance, the ability to pick choose which policies are required for a specificconfiguration keeps performance overhead down. The reduction of support for unneededpolicies can increase the overall performance of the system as well as offer flexibilityof choice. A good implementation would consider the overall security requirements andeffectively implement the various policies offered by the framework.</p><p>Thus a system utilizing <acronym class="ACRONYM">MAC</acronym> features should atleast guarantee that a user will not be permitted to change security attributes at will;all user utilities, programs and scripts must work within the constraints of the accessrules provided by the selected policies; and that total control of the <acronymclass="ACRONYM">MAC</acronym> access rules are in the hands of the systemadministrator.</p><p>It is the sole duty of the system administrator to carefully select the correctpolicies. Some environments may need to limit access control over the network; in thesecases, the <a href="http://www.FreeBSD.org/cgi/man.cgi?query=mac_portacl&sektion=4"><spanclass="CITEREFENTRY"><span class="REFENTRYTITLE">mac_portacl</span>(4)</span></a>, <ahref="http://www.FreeBSD.org/cgi/man.cgi?query=mac_ifoff&sektion=4"><spanclass="CITEREFENTRY"><span class="REFENTRYTITLE">mac_ifoff</span>(4)</span></a> and even<a href="http://www.FreeBSD.org/cgi/man.cgi?query=mac_biba&sektion=4"><spanclass="CITEREFENTRY"><span class="REFENTRYTITLE">mac_biba</span>(4)</span></a> policiesmight make good starting points. In other cases, strict confidentiality of file systemobjects might be required. Policies such as <ahref="http://www.FreeBSD.org/cgi/man.cgi?query=mac_bsdextended&sektion=4"><spanclass="CITEREFENTRY"><span class="REFENTRYTITLE">mac_bsdextended</span>(4)</span></a> and<a href="http://www.FreeBSD.org/cgi/man.cgi?query=mac_mls&sektion=4"><spanclass="CITEREFENTRY"><span class="REFENTRYTITLE">mac_mls</span>(4)</span></a> exist forthis purpose.</p><p>Policy decisions could be made based on network configuration. Perhaps only certainusers should be permitted access to facilities provided by <ahref="http://www.FreeBSD.org/cgi/man.cgi?query=ssh&sektion=1&manpath=OpenBSD+3.4"><spanclass="CITEREFENTRY"><span class="REFENTRYTITLE">ssh</span>(1)</span></a> to access thenetwork or the Internet. The <ahref="http://www.FreeBSD.org/cgi/man.cgi?query=mac_portacl&sektion=4"><spanclass="CITEREFENTRY"><span class="REFENTRYTITLE">mac_portacl</span>(4)</span></a> wouldbe the policy of choice for these situations. But what should be done in the case of filesystems? Should all access to certain directories be severed from other groups orspecific users? Or should we limit user or utility access to specific files by settingcertain objects as classified?</p><p>In the file system case, access to objects might be considered confidential to someusers but not to others. For an example, a large development team might be broken offinto smaller groups of individuals. Developers in project A might not be permitted toaccess objects written by developers in project B. Yet they might need to access objectscreated by developers in project C; that is quite a situation indeed. Using the differentpolicies provided by the <acronym class="ACRONYM">MAC</acronym> framework; users could bedivided into these groups and then given access to the appropriate areas without the fearof information leakage.</p><p>Thus, each policy has a unique way of dealing with the overall security of a system.Policy selection should be based on a well thought out security policy. In many cases,the overall policy may need to be revised and reimplemented on the system. Understandingthe different policies offered by the <acronym class="ACRONYM">MAC</acronym> frameworkwill help administrators choose the best policies for their situations.</p><p>The default FreeBSD kernel does not include the option for the <acronymclass="ACRONYM">MAC</acronym> framework; thus the following kernel option must be addedbefore trying any of the examples or information in this chapter:</p><pre class="PROGRAMLISTING">options MAC</pre><p>And the kernel will require a rebuild and a reinstall.</p><div class="CAUTION"><blockquote class="CAUTION"><p><b>Caution:</b> While the various manual pages for <acronymclass="ACRONYM">MAC</acronym> modules state that they may be built into the kernel, it ispossible to lock the system out of the network and more. Implementing <acronymclass="ACRONYM">MAC</acronym> is much like implementing a firewall, but care must betaken to prevent being completely locked out of the system. The ability to revert back toa previous configuration should be considered while the implementation of <acronymclass="ACRONYM">MAC</acronym> remotely should be done with extreme caution.</p></blockquote></div></div><div class="NAVFOOTER"><hr align="LEFT" width="100%" /><table summary="Footer navigation table" width="100%" border="0" cellpadding="0"cellspacing="0"><tr><td width="33%" align="left" valign="top"><a href="mac-inline-glossary.html"accesskey="P">Prev</a></td><td width="34%" align="center" valign="top"><a href="index.html"accesskey="H">Home</a></td><td width="33%" align="right" valign="top"><a href="mac-understandlabel.html"accesskey="N">Next</a></td></tr><tr><td width="33%" align="left" valign="top">Key Terms in this Chapter</td><td width="34%" align="center" valign="top"><a href="mac.html" accesskey="U">Up</a></td><td width="33%" align="right" valign="top">Understanding MAC Labels</td></tr></table></div><p align="center"><small>This, and other documents, can be downloaded from <ahref="ftp://ftp.FreeBSD.org/pub/FreeBSD/doc/">ftp://ftp.FreeBSD.org/pub/FreeBSD/doc/</a>.</small></p><p align="center"><small>For questions about FreeBSD, read the <ahref="http://www.FreeBSD.org/docs.html">documentation</a> before contacting <<ahref="mailto:questions@FreeBSD.org">questions@FreeBSD.org</a>>.<br />For questions about this documentation, e-mail <<ahref="mailto:doc@FreeBSD.org">doc@FreeBSD.org</a>>.</small></p></body></html>⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -