maclabel7
Mandatory access control label format
Overview
If Mandatory Access Control, or MAC, is enabled in the kernel, then in addition to the traditional credentials, each subject (typically a user or a socket) and object (file system object, socket, etc.) is given a MAC label. The MAC label specifies the necessary subject-specific or object-specific information necessary for a MAC security policy to enforce access control on the subject/object.
The format for a MAC label is defined as follows:
policy1/qualifier1,policy2/qualifier2,...
A MAC label consists of a policy name, followed by a forward slash, followed by the subject or object's qualifier, optionally followed by a comma and one or more additional policy labels. For example:
biba/low(low-low) biba/high(low-high),mls/equal(equal-equal),partition/0
Releases
56 releases since FreeBSD 5.0-RELEASE; the text changed 35 times.