||FreeBSD Kernel Interfaces Manual
Biba data integrity policy
To compile Biba into your kernel, place the following lines in your kernel
Alternately, to load the Biba module at boot time, place the
following line in your kernel configuration file:
mac_biba policy module implements the Biba integrity
model, which protects the integrity of system objects and subjects by means of
a strict information flow policy. In Biba, all system subjects and objects are
assigned integrity labels, made up of hierarchal grades, and non-hierarchal
components. Together, these label elements permit all labels to be placed in a
partial order, with information flow protections based on a dominance operator
describing the order. The hierarchal grade field is expressed as a value
between 0 and 65535, with higher values reflecting higher integrity. The
non-hierarchal compartment field is expressed as a set of up to 256
components, numbered from 0 to 255. A complete label consists of both
hierarchal and non-hierarchal elements.
Three special label values exist:
biba/high” label is
assigned to system objects which affect the integrity of the system as a
whole. The “
biba/equal” label may be
used to indicate that a particular subject or object is exempt from the Biba
protections. These special label values are not specified as containing any
compartments, although in a label comparison,
biba/high” appears to contain all
biba/equal” the same
compartments as the other label to which it is being compared, and
In general, Biba access control takes the following model:
- A subject at the same integrity level as an object may both read from and
write to the object as though Biba protections were not in place.
- A subject at a higher integrity level than an object may write to the
object, but not read the object.
- A subject at a lower integrity level than an object may read the object,
but not write to the object.
- If the subject and object labels may not be compared in the partial order,
all access is restricted.
These rules prevent subjects of lower integrity from influencing
the behavior of higher integrity subjects by preventing the flow of
information, and hence control, from allowing low integrity subjects to
modify either a high integrity object or high integrity subjects acting on
those objects. Biba integrity policies may be appropriate in a number of
environments, both from the perspective of preventing corruption of the
operating system, and corruption of user data if marked as higher integrity
than the attacker. In traditional trusted operating systems, the Biba
integrity model is used to protect the Trusted Code Base (TCB).
The Biba integrity model is similar to
with the exception that LOMAC permits access by a higher integrity subject
to a lower integrity object, but downgrades the integrity level of the
subject to prevent integrity rules from being violated. Biba is a fixed
label policy in that all subject and object label changes are explicit,
whereas LOMAC is a floating label policy.
The Biba integrity model is also similar to
with the exception that the dominance operator and access rules are
reversed, preventing the downward flow of information rather than the upward
flow of information. Multi-Level Security (MLS) protects the
confidentiality, rather than the integrity, of subjects and objects.
Almost all system objects are tagged with an effective, active label element,
reflecting the integrity of the object, or integrity of the data contained in
the object. In general, objects labels are represented in the following form:
Subject labels consist of three label elements: an effective
(active) label, as well as a range of available labels. This range is
represented using two ordered Biba label elements, and when set on a
process, permits the process to change its active label to any label of
greater or equal integrity to the low end of the range, and lesser or equal
integrity to the high end of the range. In general, subject labels are
represented in the following form:
Valid ranged labels must meet the following requirement regarding
One class of objects with ranges currently exists, the network
interface. In the case of the network interface, the effective label element
references the default label for packets received over the interface, and
the range represents the range of acceptable labels of packets to be
transmitted over the interface.
MIBs are available for fine-tuning the enforcement of this MAC policy.
- Enables enforcement of the Biba integrity policy. (Default: 1).
biba/equal” upon creation.
- Revoke access to objects if the label is changed to dominate the subject.
mac_biba policy module first appeared in
FreeBSD 5.0 and was developed by the TrustedBSD
This software was contributed to the FreeBSD Project by
Network Associates Labs, the Security Research Division of Network Associates
Inc. under DARPA/SPAWAR contract N66001-01-C-8035 (“CBOSS”), as
part of the DARPA CHATS research program.
Visit the GSP FreeBSD Man Page Interface.
Output converted with ManDoc.