Biba data integrity policy
SYNOPSISTo compile Biba into your kernel, place the following lines in your kernel configuration file:
Alternately, to load the Biba module at boot time, place the following line in your kernel configuration file:
and in loader.conf(5):
Three special label values exist:
In general, Biba access control takes the following model:
These rules prevent subjects of lower integrity from influencing the behavior of higher integrity subjects by preventing the flow of information, and hence control, from allowing low integrity subjects to modify either a high integrity object or high integrity subjects acting on those objects. Biba integrity policies may be appropriate in a number of environments, both from the perspective of preventing corruption of the operating system, and corruption of user data if marked as higher integrity than the attacker. In traditional trusted operating systems, the Biba integrity model is used to protect the Trusted Code Base (TCB).
The Biba integrity model is similar to mac_lomac(4), with the exception that LOMAC permits access by a higher integrity subject to a lower integrity object, but downgrades the integrity level of the subject to prevent integrity rules from being violated. Biba is a fixed label policy in that all subject and object label changes are explicit, whereas LOMAC is a floating label policy.
The Biba integrity model is also similar to mac_mls(4), with the exception that the dominance operator and access rules are reversed, preventing the downward flow of information rather than the upward flow of information. Multi-Level Security (MLS) protects the confidentiality, rather than the integrity, of subjects and objects.
Label FormatAlmost all system objects are tagged with an effective, active label element, reflecting the integrity of the object, or integrity of the data contained in the object. In general, objects labels are represented in the following form:
Subject labels consist of three label elements: an effective (active) label, as well as a range of available labels. This range is represented using two ordered Biba label elements, and when set on a process, permits the process to change its active label to any label of greater or equal integrity to the low end of the range, and lesser or equal integrity to the high end of the range. In general, subject labels are represented in the following form:
Valid ranged labels must meet the following requirement regarding their elements:
rangehigh ≥ effective ≥ rangelow
One class of objects with ranges currently exists, the network interface. In the case of the network interface, the effective label element references the default label for packets received over the interface, and the range represents the range of acceptable labels of packets to be transmitted over the interface.
Runtime ConfigurationThe following sysctl(8) MIBs are available for fine-tuning the enforcement of this MAC policy.
SEE ALSOmac(4), mac_bsdextended(4), mac_ifoff(4), mac_lomac(4), mac_mls(4), mac_none(4), mac_partition(4), mac_portacl(4), mac_seeotheruids(4), mac_test(4), maclabel(7), mac(9)
AUTHORSThis software was contributed to the FreeBSD Project by Network Associates Labs, the Security Research Division of Network Associates Inc. under DARPA/SPAWAR contract N66001-01-C-8035 (“CBOSS”), as part of the DARPA CHATS research program.
Visit the GSP FreeBSD Man Page Interface.