path: root/ru_RU.KOI8-R/books/handbook/mac/chapter.sgml

<!--
     The FreeBSD Russian Documentation Project

     $FreeBSD$
     $FreeBSDru: frdp/doc/ru_RU.KOI8-R/books/handbook/mac/chapter.sgml,v 1.17 2004/11/26 14:34:37 den Exp $

     Original revision: 1.30
-->

<chapter id="mac">
  <chapterinfo>
    <authorgroup>
      <author>
	<firstname>Tom</firstname>
	<surname>Rhodes</surname>
	<contrib>îÁÐÉÓÁÌ </contrib>
      </author>
    </authorgroup>
    <authorgroup>
      <author>
	<firstname>äÅÎÉÓ</firstname>
	<surname>ðÅÐÌÉÎ</surname>
	<contrib>ðÅÒÅ×ÏÄ ÎÁ ÒÕÓÓËÉÊ ÑÚÙË: </contrib>
      </author>
    </authorgroup>
  </chapterinfo>

  <title>ðÒÉÎÕÄÉÔÅÌØÎÙÊ ËÏÎÔÒÏÌØ ÄÏÓÔÕÐÁ (MAC)</title>

  <sect1 id="mac-synopsis">
    <title>ëÒÁÔËÉÊ ÏÂÚÏÒ</title>

    <indexterm><primary>MAC</primary></indexterm>
    <indexterm><primary>Mandatory Access Control</primary></indexterm>
    <indexterm><primary>ðÒÉÎÕÄÉÔÅÌØÎÙÊ ËÏÎÔÒÏÌØ ÄÏÓÔÕÐÁ</primary></indexterm>

    <para>&os;&nbsp;5.X ÐÒÅÄÓÔÁ×ÌÑÅÔ ÎÏ×ÙÅ ÒÁÓÛÉÒÅÎÉÑ ÓÉÓÔÅÍÙ ÂÅÚÏÐÁÓÎÏÓÔÉ
      ÏÔ ÐÒÏÅËÔÁ TrustedBSD, ÏÓÎÏ×ÁÎÎÙÅ ÎÁ ÄÏËÕÍÅÎÔÁÈ &posix;.1e.
      ä×Á ÉÚ ÎÁÉÂÏÌÅÅ ×ÁÖÎÙÈ ÎÏ×Ï××ÅÄÅÎÉÊ × ÍÅÈÁÎÉÚÍÁÈ ÂÅÚÏÐÁÓÎÏÓÔÉ ÜÔÏ
      ÓÐÉÓËÉ ËÏÎÔÒÏÌÑ ÄÏÓÔÕÐÁ ÆÁÊÌÏ×ÏÊ ÓÉÓÔÅÍÙ (Access Control Lists,
      <acronym>ACLs</acronym>) É ÐÒÉÎÕÄÉÔÅÌØÎÙÊ ËÏÎÔÒÏÌØ ÄÏÓÔÕÐÁ
      Mandatory Access Control, <acronym>MAC</acronym>).  éÎÆÒÁÓÔÒÕËÔÕÒÁ
      ÐÏÚ×ÏÌÑÅÔ ÚÁÇÒÕÖÁÔØ ÎÏ×ÙÅ ÍÏÄÕÌÉ ËÏÎÔÒÏÌÑ ÄÏÓÔÕÐÁ,
      ÒÅÁÌÉÚÕÑ ÎÏ×ÙÅ ÐÏÌÉÔÉËÉ ÂÅÚÏÐÁÓÎÏÓÔÉ.  îÅËÏÔÏÒÙÅ ÉÚ ÎÉÈ ÐÒÅÄÏÓÔÁ×ÌÑÀÔ
      ÚÁÝÉÔÕ ËÌÀÞÅ×ÙÈ ÐÏÄÓÉÓÔÅÍ, ÚÁÝÉÝÁÑ ÏÐÒÅÄÅÌÅÎÎÙÊ ÓÅÒ×ÉÓ, × ÔÏ ×ÒÅÍÑ
      ËÁË ÄÒÕÇÉÅ ÐÒÅÄÏÓÔÁ×ÌÑÀÔ ÉÓÞÅÒÐÙ×ÁÀÝÕÀ ÓÉÓÔÅÍÕ ÂÅÚÏÐÁÓÎÏÓÔÉ Ó ÍÅÔËÁÍÉ
      ÎÁ ×ÓÅÈ ÓÕÂßÅËÔÁÈ É ÏÂßÅËÔÁÈ.  ëÏÎÔÒÏÌØ ÎÁÚÙ×ÁÅÔÓÑ ÐÒÉÎÕÄÉÔÅÌØÎÙÍ,
      ÐÏÓËÏÌØËÕ ÐÒÉÍÅÎÅÎÉÅ ËÏÎÔÒÏÌÑ ÐÒÏÉÚ×ÏÄÉÔÓÑ ÁÄÍÉÎÉÓÔÒÁÔÏÒÁÍÉ É
      ÓÉÓÔÅÍÏÊ, É ÎÅ ÚÁ×ÉÓÉÔ ÏÔ ÒÅÛÅÎÉÑ ÐÏÌØÚÏ×ÁÔÅÌÅÊ, ËÁË ÜÔÏ ÐÒÏÉÓÈÏÄÉÔ
      ÐÒÉ ÏÂÙÞÎÏÍ ËÏÎÔÒÏÌÅ ÄÏÓÔÕÐÁ (Discretionary Access Control,
      <acronym>DAC</acronym>, ÓÔÁÎÄÁÒÔÎÙÅ ÆÁÊÌÏ×ÙÅ É System V IPC
      ÐÒÁ×Á × &os;).</para>

    <para>÷ÓÑ ÜÔÁ ÇÌÁ×Á ÆÏËÕÓÉÒÕÅÔÓÑ ÎÁ ÉÎÆÒÁÓÔÒÕËÔÕÒÅ
      ÐÒÉÎÕÄÉÔÅÌØÎÏÇÏ ËÏÎÔÒÏÌÑ ÄÏÓÔÕÐÁ É ÎÁÓÔÒÏÊËÅ
      ÐÏÄËÌÀÞÁÅÍÙÈ ÍÏÄÕÌÅÊ, ÒÅÁÌÉÚÕÀÝÉÈ ÒÁÚÌÉÞÎÙÅ ÐÏÌÉÔÉËÉ
      ÂÅÚÏÐÁÓÎÏÓÔÉ.</para>

    <para>ðÏÓÌÅ ÐÒÏÞÔÅÎÉÑ ÜÔÏÊ ÇÌÁ×Ù ×Ù ÕÚÎÁÅÔÅ:</para>

    <itemizedlist>
      <listitem>
	<para>ëÁËÉÅ ÍÏÄÕÌÉ <acronym>MAC</acronym> ×ËÌÀÞÅÎÙ × ÎÁÓÔÏÑÝÅÅ
	  ×ÒÅÍÑ × &os;, ËÁËÉÅ ÐÏÌÉÔÉËÉ Ó ÎÉÍÉ Ó×ÑÚÁÎÙ.</para>
      </listitem>

      <listitem>
	<para>þÔÏ ÓÐÏÓÏÂÎÙ ÒÅÁÌÉÚÏ×ÁÔØ ÐÏÌÉÔÉËÉ <acronym>MAC</acronym>,
	  ÒÁÚÌÉÞÉÅ ÍÅÖÄÕ ÐÏÌÉÔÉËÁÍÉ Ó ÍÅÔËÁÍÉ (label) É ÂÅÚ
	  ÍÅÔÏË.</para>
      </listitem>

      <listitem>
	<para>ëÁË ÜÆÆÅËÔÉ×ÎÏ ÎÁÓÔÒÏÉÔØ ÓÉÓÔÅÍÕ ÄÌÑ ÉÓÐÏÌØÚÏ×ÁÎÉÑ
	  ÉÎÆÒÁÓÔÒÕËÔÕÒÙ <acronym>MAC</acronym>.</para>
      </listitem>

      <listitem>
	<para>ëÁË ÎÁÓÔÒÏÉÔØ ÒÁÚÌÉÞÎÙÅ ÐÏÌÉÔÉËÉ, ÉÓÐÏÌØÚÕÅÍÙÅ ÍÏÄÕÌÑÍÉ
	  <acronym>MAC</acronym>.</para>
      </listitem>

      <listitem>
	<para>ëÁË ÒÅÁÌÉÚÏ×ÁÔØ ÂÏÌÅÅ ÚÁÝÉÝÅÎÎÕÀ ÓÒÅÄÕ, ÉÓÐÏÌØÚÕÑ ÉÎÆÒÁÓÔÒÕËÔÕÒÕ
	  <acronym>MAC</acronym> É ÐÒÉ×ÅÄÅÎÎÙÅ ÐÒÉÍÅÒÙ.</para>
      </listitem>

      <listitem>
	<para>ëÁË ÐÒÏÔÅÓÔÉÒÏ×ÁÔØ ÎÁÓÔÒÏÊËÕ <acronym>MAC</acronym>,
	  ÞÔÏÂÙ ÕÂÅÄÉÔØÓÑ, ÞÔÏ ÉÎÆÒÁÓÔÒÕËÔÕÒÁ ÂÙÌÁ ÒÅÁÌÉÚÏ×ÁÎÁ ÐÒÁ×ÉÌØÎÏ.</para>
      </listitem>
    </itemizedlist>

    <para>ðÅÒÅÄ ÐÒÏÞÔÅÎÉÅÍ ÜÔÏÊ ÇÌÁ×Ù ×ÁÍ ÐÏÔÒÅÂÕÅÔÓÑ:</para>

    <itemizedlist>
      <listitem>
	<para>ðÏÎÉÍÁÎÉÅ ÏÓÎÏ× &unix; É &os;
	  (<xref linkend="basics">).</para>
      </listitem>

      <listitem>
	<para>ïÚÎÁËÏÍÉÔØÓÑ Ó ÏÓÎÏ×ÁÍÉ
	  ÎÁÓÔÒÏÊËÉ/ËÏÍÐÉÌÉÒÏ×ÁÎÉÑ ÑÄÒÁ
	  (<xref linkend="kernelconfig">).</para>
      </listitem>

      <listitem>
	<para>éÍÅÔØ ÎÅËÏÔÏÒÙÅ ÐÏÎÑÔÉÑ Ï ÂÅÚÏÐÁÓÎÏÓÔÉ É ËÁË ÏÎÁ
	  ÏÔÎÏÓÉÔÓÑ Ë &os; (<xref linkend="security">).</para>
      </listitem>
    </itemizedlist>

    <warning>
      <para>îÅÐÒÁ×ÉÌØÎÏÅ ÉÓÐÏÌØÚÏ×ÁÎÉÅ ÉÎÆÏÒÍÁÃÉÉ ÜÔÏÊ ÇÌÁ×Ù
	ÍÏÖÅÔ ×ÙÚ×ÁÔØ ÐÏÔÅÒÀ ÄÏÓÔÕÐÁ Ë ÓÉÓÔÅÍÅ, ÐÒÏÂÌÅÍÙ
	Õ ÐÏÌØÚÏ×ÁÔÅÌÅÊ, ÉÌÉ ÎÅ×ÏÚÍÏÖÎÏÓÔØ ÚÁÐÕÓËÁ &xfree86;.
	þÔÏ ÂÏÌÅÅ ×ÁÖÎÏ, <acronym>MAC</acronym>
	ÎÅ ÄÏÌÖÅÎ ×ÏÓÐÒÉÎÉÍÁÔØÓÑ ËÁË ÐÏÌÎÁÑ ÚÁÝÉÔÁ ÓÉÓÔÅÍÙ.
	éÎÆÒÁÓÔÒÕËÔÕÒÁ <acronym>MAC</acronym> ÌÉÛØ ÕÓÉÌÉ×ÁÅÔ
	ÉÍÅÀÝÕÀÓÑ ÓÉÓÔÅÍÕ ÂÅÚÏÐÁÓÎÏÓÔÉ:
	ÂÅÚ ÐÒÉÍÅÎÅÎÉÑ ÍÅÔÏÄÏ× ÚÁÝÉÔÙ É ÒÅÇÕÌÑÒÎÙÈ ÐÒÏ×ÅÒÏË,
	ÓÉÓÔÅÍÁ ÎÉËÏÇÄÁ ÎÅ ÓÔÁÎÅÔ ÐÏÌÎÏÓÔØÀ ÚÁÝÉÝÅÎÎÏÊ.</para>

      <para>îÅÏÂÈÏÄÉÍÏ ÔÁËÖÅ ÕÞÅÓÔØ, ÞÔÏ ÐÒÉÍÅÒÙ, ÐÒÉ×ÅÄÅÎÎÙÅ × ÜÔÏÊ ÇÌÁ×Å,
	ÜÔÏ ×ÓÅÇÏ ÌÉÛØ ÐÒÉÍÅÒÙ.  îÅ ÒÅËÏÍÅÎÄÕÅÔÓÑ ÄÕÂÌÉÒÏ×ÁÎÉÅ ÜÔÉÈ
	ÎÁÓÔÒÏÅË ÄÌÑ ÒÅÁÌØÎÙÈ ÚÁÄÁÞ.  òÅÁÌÉÚÁÃÉÑ ÐÏÌÉÔÉË ÂÅÚÏÐÁÓÎÏÓÔÉ ÔÒÅÂÕÅÔ
	×ÄÕÍÞÉ×ÏÇÏ ÐÌÁÎÉÒÏ×ÁÎÉÑ.  ôÏÔ, ËÔÏ ÎÅ ÐÏÎÑÌ ÐÏÌÎÏÓÔØÀ ËÁË ×ÓÅ
	ÜÔÏ ÎÁ ÓÁÍÏÍ ÄÅÌÅ ÒÁÂÏÔÁÅÔ, ÍÏÖÅÔ ÓÔÏÌËÎÕÔØÓÑ Ó ÎÅÏÂÈÏÄÉÍÏÓÔØÀ
	ÐÏ×ÔÏÒÎÏÊ ÐÏÌÎÏÊ ÐÅÒÅÎÁÓÔÒÏÊËÉ ÓÉÓÔÅÍÙ ÂÅÚÏÐÁÓÎÏÓÔÉ ÄÌÑ ÍÎÏÇÉÈ
	ÆÁÊÌÏ× É ËÁÔÁÌÏÇÏ×.</para>
    </warning>

    <sect2>
      <title>þÔÏ ÎÅ ÂÕÄÅÔ ÚÁÔÒÏÎÕÔÏ</title>

      <para>÷ ÜÔÏÊ ÇÌÁ×Å ÏÈ×ÁÞÅÎ ÛÉÒÏËÉÊ ÓÐÅËÔÒ ×ÏÐÒÏÓÏ× ÂÅÚÏÐÁÓÎÏÓÔÉ,
	ÏÔÎÏÓÑÝÉÈÓÑ Ë ÉÎÆÒÁÓÔÒÕËÔÕÒÅ <acronym>MAC</acronym>.  ÏÄÎÁËÏ
	ÒÁÚÒÁÂÏÔËÁ ÐÏÌÉÔÉË <acronym>MAC</acronym> ÎÅ
	ÂÕÄÅÔ ÚÁÔÒÏÎÕÔÁ.  îÅÓËÏÌØËÏ ÍÏÄÕÌÅÊ, ×ËÌÀÞÅÎÎÙÈ × ÉÎÆÒÁÓÔÒÕËÔÕÒÕ
	<acronym>MAC</acronym>, ÉÍÅÀÔ ÏÓÏÂÙÅ ÈÁÒÁËÔÅÒÉÓÔÉËÉ, ËÏÔÏÒÙÅ
	ÐÒÅÄÎÁÚÎÁÞÅÎÙ ÄÌÑ ÔÅÓÔÉÒÏ×ÁÎÉÑ É ÒÁÚÒÁÂÏÔËÉ ÎÏ×ÙÈ ÍÏÄÕÌÅÊ.
	üÔÏ ÏÔÎÏÓÉÔÓÑ Ë ÍÏÄÕÌÑÍ/ÐÏÌÉÔÉËÁÍ &man.mac.test.4;,
	&man.mac.stub.4; É &man.mac.none.4;.
	úÁ ÄÁÌØÎÅÊÛÅÊ ÉÎÆÏÒÍÁÃÉÅÊ ÐÏ ÜÔÉÍ ÍÏÄÕÌÑÍ É ÒÁÚÌÉÞÎÙÍ
	ÐÒÅÄÏÓÔÁ×ÌÑÅÍÙÍ ÉÍÉ ÍÅÈÁÎÉÚÍÁÍ, ÏÂÒÁÔÉÔÅÓØ Ë ÓÏÏÔ×ÅÔÓÔ×ÕÀÝÉÍ
	ÓÔÒÁÎÉÃÁÍ ÓÐÒÁ×ÏÞÎÉËÁ.</para>
    </sect2>
  </sect1>

  <sect1 id="mac-inline-glossary">
    <title>ëÌÀÞÅ×ÙÅ ÔÅÒÍÉÎÙ ÜÔÏÊ ÇÌÁ×Ù</title>

    <para>ðÅÒÅÄ ÞÔÅÎÉÅÍ ÜÔÏÊ ÇÌÁ×Ù ÎÅÏÂÈÏÄÉÍÏ ÏÚÎÁËÏÍÉÔØÓÑ Ó ÎÅËÏÔÏÒÙÍÉ
      ËÌÀÞÅ×ÙÍÉ ÔÅÒÍÉÎÁÍÉ.  üÔÏ ×ÏÚÍÏÖÎÏ ÒÁÚÒÅÛÉÔ ×ÏÚÎÉËÁÀÝÉÅ ×ÏÐÒÏÓÙ
      É ÐÒÅÄÏÔ×ÒÁÔÉÔ ÐÅÒÅÇÒÕÚËÕ ÍÁÔÅÒÉÁÌÁ ÎÏ×ÙÍÉ ÔÅÒÍÉÎÁÍÉ É
      ÉÎÆÏÒÍÁÃÉÅÊ.</para>

    <itemizedlist>
      <listitem>
	<para><emphasis>ÏÔÄÅÌ</emphasis> (compartment): ïÔÄÅÌ ÜÔÏ ÎÁÂÏÒ
	  ÐÒÏÇÒÁÍÍ É ÄÁÎÎÙÈ, ËÏÔÏÒÙÅ ÎÅÏÂÈÏÄÉÍÏ ÏÔÄÅÌÉÔØ, É ÇÄÅ
	  ÐÏÌØÚÏ×ÁÔÅÌÉ ÐÏÌÕÞÁÀÔ Ñ×ÎÙÊ ÄÏÓÔÕÐ Ë ÏÔÄÅÌØÎÙÍ
	  ËÏÍÐÏÎÅÎÔÁÍ ÓÉÓÔÅÍÙ.  ïÔÄÅÌ ÐÒÅÄÓÔÁ×ÌÑÅÔ ÇÒÕÐÐÉÒÏ×ÁÎÉÅ, ÎÁÐÒÉÍÅÒ
	  ÒÁÂÏÞÕÀ ÇÒÕÐÐÕ, ÄÅÐÁÒÔÁÍÅÎÔ, ÐÒÏÅËÔ ÉÌÉ ÔÅÍÕ.  ó ÉÓÐÏÌØÚÏ×ÁÎÉÅÍ
	  ÏÔÄÅÌÏ× ×ÏÚÍÏÖÎÁ ÒÅÁÌÉÚÁÃÉÑ ÐÏÌÉÔÉËÉ Ó Ñ×ÎÏ ÏÐÒÅÄÅÌÅÎÎÙÍ
	  ÄÏÓÔÕÐÏÍ.</para>
      </listitem>

      <listitem>
	<para><emphasis>ÃÅÌÏÓÔÎÏÓÔØ</emphasis> (integrity): ãÅÌÏÓÔÎÏÓÔØ, ËÁË
	  ËÌÀÞÅ×ÁÑ ËÏÎÃÅÐÃÉÑ, ÜÔÏ ÕÒÏ×ÅÎØ ÄÏ×ÅÒÉÑ, ËÏÔÏÒÙÊ ÍÏÖÅÔ ÂÙÔØ
	  ÐÒÉÓ×ÏÅÎ ÄÁÎÎÙÍ.  ðÏÓËÏÌØËÕ ÃÅÌÏÓÔÎÏÓÔØ ÄÁÎÎÙÈ ÐÏ×ÙÛÁÅÔÓÑ,
	  ÜÔÏ ÄÁÅÔ ×ÏÚÍÏÖÎÏÓÔØ ÄÏ×ÅÒÑÔØ ÄÁÎÎÙÍ.</para>
      </listitem>

      <listitem>
	<para><emphasis>ÍÅÔËÁ</emphasis> (label): íÅÔËÁ Ñ×ÌÑÅÔÓÑ ÉÎÓÔÒÕÍÅÎÔÏÍ
	  ÂÅÚÏÐÁÓÎÏÓÔÉ, ÏÎÁ ÍÏÖÅÔ ÂÙÔØ ÐÒÉÍÅÎÅÎÁ Ë ÆÁÊÌÁÍ, ËÁÔÁÌÏÇÁÍ É ÄÒÕÇÉÍ
	  ÓÕÝÎÏÓÔÑÍ ÓÉÓÔÅÍÙ.  åÅ ÍÏÖÎÏ ÐÒÅÄÓÔÁ×ÉÔØ ËÁË ÛÔÁÍÐ
	  ËÏÎÆÉÄÅÎÃÉÁÌØÎÏÓÔÉ; ÍÅÔËÁ, ÐÏÍÅÝÅÎÎÁÑ ÎÁ ÆÁÊÌ, ÏÐÉÓÙ×ÁÅÔ ÕÒÏ×ÅÎØ
	  ÓÅËÒÅÔÎÏÓÔÉ ÄÁÎÎÏÇÏ ÆÁÊÌÁ É ÒÁÚÒÅÛÉÔ ÄÏÓÔÕÐ ÔÏÌØËÏ ÆÁÊÌÁÍ,
	  ÐÏÌØÚÏ×ÁÔÅÌÑÍ, ÒÅÓÕÒÓÁÍ É Ô.Ä. Ó ÔÅÍÉ ÖÅ ÉÌÉ ÍÅÎØÛÉÍÉ ÕÓÔÁÎÏ×ËÁÍÉ
	  ÂÅÚÏÐÁÓÎÏÓÔÉ.  îÅËÏÔÏÒÙÅ ÉÚ ÐÏÌÉÔÉË ÍÏÇÕÔ ÏÂÒÁÂÁÔÙ×ÁÔØ ÍÅÔËÉ
	  ÒÁÚÌÉÞÎÙÍÉ ÓÐÏÓÏÂÁÍÉ; ÜÔÏ ÂÕÄÅÔ ÏÂÓÕÖÄÁÔØÓÑ × ÒÁÚÄÅÌÅ ÐÏÌÉÔÉË
	  ÎÉÖÅ.</para>
      </listitem>

      <listitem>
	<para><emphasis>multilabel</emphasis> (ÍÎÏÖÅÓÔ×ÅÎÎÙÅ ÍÅÔËÉ):
	  Ó×ÏÊÓÔ×Ï <option>multilabel</option>
	  ÜÔÏ ÐÁÒÁÍÅÔÒ ÆÁÊÌÏ×ÏÊ ÓÉÓÔÅÍÙ, ËÏÔÏÒÙÊ ÍÏÖÅÔ ÂÙÔØ ÕÓÔÁÎÏ×ÌÅÎ
	  × ÏÄÎÏÐÏÌØÚÏ×ÁÔÅÌØÓËÏÍ ÒÅÖÉÍÅ Ó ÐÏÍÏÝØÀ ÕÔÉÌÉÔÙ
	  &man.tunefs.8;, ×Ï ×ÒÅÍÑ ÚÁÇÒÕÚËÉ ÞÅÒÅÚ ÆÁÊÌ &man.fstab.5;,
	  ÉÌÉ ÐÒÉ ÓÏÚÄÁÎÉÉ ÎÏ×ÏÊ ÆÁÊÌÏ×ÏÊ ÓÉÓÔÅÍÙ.  üÔÏÔ ÐÁÒÁÍÅÔÒ
	  ÐÏÚ×ÏÌÑÅÔ ÁÄÍÉÎÉÓÔÒÁÔÏÒÕ ÐÏÍÅÝÁÔØ ÒÁÚÌÉÞÎÙÅ ÍÅÔËÉ
	  <acronym>MAC</acronym> ÎÁ ÒÁÚÌÉÞÎÙÅ ÏÂßÅËÔÙ.
	  ÒÁÚÒÅÛÁÅÔ ÐÏÍÅÝÅÎÉÅ ÍÎÏÖÅÓÔ×ÅÎÎÙÈ <acronym>MAC</acronym> ÍÅÔÏË
	  ÎÁ ÆÁÊÌÙ É ËÁÔÁÌÏÇÉ ÆÁÊÌÏ×ÏÊ ÓÉÓÔÅÍÙ.  üÔÏÔ ÐÁÒÁÍÅÔÒ
	  ÐÒÉÍÅÎÉÍ ÔÏÌØËÏ Ë ÐÏÌÉÔÉËÁÍ Ó ÍÅÔËÁÍÉ.</para>
      </listitem>

      <listitem>
	<para><emphasis>ÏÂßÅËÔ</emphasis> (object): ïÂßÅËÔ ÉÌÉ
	  ÓÉÓÔÅÍÎÙÊ ÏÂßÅËÔ ÜÔÏ ÓÕÝÎÏÓÔØ, ÞÅÒÅÚ ËÏÔÏÒÕÀ ÉÎÆÏÒÍÁÃÉÑ
	  ÐÒÏÈÏÄÉÔ Ë <emphasis>ÓÕÂßÅËÔÕ</emphasis>.  üÔÏ ÍÏÇÕÔ ÂÙÔØ
	  ËÁÔÁÌÏÇÉ, ÆÁÊÌÙ, ÐÏÌÑ, ÜËÒÁÎÙ, ËÌÁ×ÉÁÔÕÒÙ, ÐÁÍÑÔØ,
	  ÍÁÇÎÉÔÎÙÅ ÎÁËÏÐÉÔÅÌÉ, ÐÒÉÎÔÅÒÙ ÉÌÉ ÌÀÂÙÅ ÄÒÕÇÉÅ ÕÓÔÒÏÊÓÔ×Á
	  ÈÒÁÎÅÎÉÑ/ÐÅÒÅÍÅÝÅÎÉÑ ÄÁÎÎÙÈ.  ÷ ÓÕÝÎÏÓÔÉ ÜÔÏ ËÏÎÔÅÊÎÅÒ ÄÁÎÎÙÈ
	  ÉÌÉ ÒÅÓÕÒÓ ÓÉÓÔÅÍÙ; ÄÏÓÔÕÐ Ë <emphasis>ÏÂßÅËÔÕ</emphasis>
	  ÆÁËÔÉÞÅÓËÉ ÏÚÎÁÞÁÅÔ ÄÏÓÔÕÐ Ë ÄÁÎÎÙÍ.</para>
      </listitem>

      <listitem>
	<para><emphasis>ÐÏÌÉÔÉËÁ</emphasis> (policy): îÁÂÏÒ ÐÒÁ×ÉÌ,
	  ÏÐÒÅÄÅÌÑÀÝÉÈ ËÁË ÄÏÓÔÉÞØ ÏÂßÅËÔÁ.  <emphasis>ðÏÌÉÔÉËÁ</emphasis>
	  ÏÂÙÞÎÏ ÄÏËÕÍÅÎÔÉÒÕÅÔ ÏÂÒÁÝÅÎÉÅ Ó ÏÐÒÅÄÅÌÅÎÎÙÍÉ ÜÌÅÍÅÎÔÁÍÉ.
	  ÷ ÜÔÏÊ ÇÌÁ×Å <emphasis>ÐÏÌÉÔÉËÁ</emphasis> ÂÕÄÅÔ ÏÚÎÁÞÁÔØ
	  <emphasis>ÐÏÌÉÔÉËÕ ÂÅÚÏÐÁÓÎÏÓÔÉ</emphasis>; Ô.Å.
	  ËÏÌÌÅËÃÉÀ ÐÒÁ×ÉÌ, ËÏÔÏÒÙÅ ÂÕÄÕÔ ËÏÎÔÒÏÌÉÒÏ×ÁÔØ ÐÏÔÏË ÄÁÎÎÙÈ
	  É ÏÐÒÅÄÅÌÑÔØ ËÔÏ ÂÕÄÅÔ ÉÍÅÔØ ÄÏÓÔÕÐ Ë ÜÔÉÍ ÄÁÎÎÙÍ.</para>
	  <!-- translation: data and information -> ÄÁÎÎÙÅ -->
      </listitem>

      <listitem>
	<para><emphasis>ÞÕ×ÓÔ×ÉÔÅÌØÎÏÓÔØ</emphasis> (sensitivity):
	  ïÂÙÞÎÏ ÉÓÐÏÌØÚÕÅÔÓÑ ÐÒÉ ÏÂÓÕÖÄÅÎÉÉ <acronym>MLS</acronym>.
	  õÒÏ×ÅÎØ ÞÕ×ÓÔ×ÉÔÅÌØÎÏÓÔÉ ÜÔÏ ÔÅÒÍÉÎ, ÉÓÐÏÌØÚÕÅÍÙÊ ÄÌÑ ÏÐÉÓÁÎÉÑ
	  ÔÏÇÏ, ÎÁÓËÏÌØËÏ ×ÁÖÎÙ ÉÌÉ ÓÅËÒÅÔÎÙ ÄÁÎÎÙÅ.  õ×ÅÌÉÞÅÎÉÅ
	  ÕÒÏ×ÎÑ ÞÕ×ÓÔ×ÉÔÅÌØÎÏÓÔÉ ÏÚÎÁÞÁÅÔ ×ÁÖÎÏÓÔØ ÄÁÎÎÙÈ.</para>
      </listitem>

      <listitem>
	<para><emphasis>ÏÄÉÎÏÞÎÁÑ ÍÅÔËÁ</emphasis> (single label): ÏÚÎÁÞÁÅÔ,
	  ÞÔÏ ×ÓÑ ÆÁÊÌÏ×ÁÑ ÓÉÓÔÅÍÁ ÉÓÐÏÌØÚÕÅÔ ÏÄÎÕ ÍÅÔËÕ ÄÌÑ
	  ÏÐÒÅÄÅÌÅÎÉÑ ÄÏÓÔÕÐÁ ×ÓÅÇÏ ÐÏÔÏËÁ ÄÁÎÎÙÈ.  ëÏÇÄÁ ÆÁÊÌÏ×ÁÑ ÓÉÓÔÅÍÁ
	  ÉÓÐÏÌØÚÕÅÔ ÜÔÕ ÕÓÔÁÎÏ×ËÕ, ÞÔÏ ÐÒÏÉÓÈÏÄÉÔ ×ÓÅÇÄÁ, ÅÓÌÉ ÎÅ
	  ÕÓÔÁÎÏ×ÌÅÎ ÐÁÒÁÍÅÔÒ <option>multilabel</option>,  ËÏ ×ÓÅÍ
	  ÆÁÊÌÁÍ ÂÕÄÅÔ ÐÒÉÍÅÎÑÔØÓÑ ÏÄÎÁ É ÔÁ ÖÅ ÕÓÔÁÎÏ×ËÁ ÍÅÔËÉ.</para>
      </listitem>

      <listitem>
	<para><emphasis>ÓÕÂßÅËÔ</emphasis> (subject): ÓÕÂßÅËÔ ÜÔÏ
	  ÌÀÂÁÑ ÁËÔÉ×ÎÁÑ ÓÕÝÎÏÓÔØ, ×ÙÚÙ×ÁÀÝÁÑ ÐÅÒÅÍÅÝÅÎÉÅ ÉÎÆÏÒÍÁÃÉÉ
	  ÍÅÖÄÕ <emphasis>ÏÂßÅËÔÁÍÉ</emphasis>; Ô.Å. ÐÏÌØÚÏ×ÁÔÅÌØ,
	  ÐÏÌØÚÏ×ÁÔÅÌØÓËÉÊ ÏÂÒÁÂÏÔÞÉË, ÓÉÓÔÅÍÎÙÊ ÐÒÏÃÅÓÓ É Ô.Ä.
	  ÷ &os; ÜÔÏ ÐÏÞÔÉ ×ÓÅÇÄÁ ÐÏÔÏË, ÒÁÂÏÔÁÀÝÉÊ × ÐÒÏÃÅÓÓÅ ÉÌÉ
	  ÐÒÅÄÓÔÁ×ÌÑÀÝÉÊ ÐÏÌØÚÏ×ÁÔÅÌÑ.</para>
      </listitem>
    </itemizedlist>
  </sect1>

  <sect1 id="mac-initial">
    <title>ïÐÉÓÁÎÉÅ MAC</title>

    <para>õÓ×ÏÉ× ×ÓÅ ÜÔÉ ÔÅÒÍÉÎÙ, ÒÁÓÓÍÏÔÒÉÍ ËÁË <acronym>MAC</acronym>
      ÐÏ×ÙÛÁÅÔ ÂÅÚÏÐÁÓÎÏÓÔØ ÓÉÓÔÅÍÙ × ÃÅÌÏÍ.  òÁÚÌÉÞÎÙÅ ÐÏÌÉÔÉËÉ,
      ÐÒÅÄÏÓÔÁ×ÌÑÅÍÙÅ ÉÎÆÒÁÓÔÒÕËÔÕÒÏÊ <acronym>MAC</acronym>,
      ÍÏÇÕÔ ÂÙÔØ ÉÓÐÏÌØÚÏ×ÁÎÙ ÄÌÑ ÚÁÝÉÔÙ ÓÅÔÉ É ÆÁÊÌÏ×ÙÈ ÓÉÓÔÅÍ,
      ÂÌÏËÉÒÏ×ÁÎÉÑ ÄÏÓÔÕÐÁ ÐÏÌØÚÏ×ÁÔÅÌÅÊ Ë ÏÐÒÅÄÅÌÅÎÎÙÍ ÐÏÒÔÁÍ É
      ÓÏËÅÔÁÍ, É ÔÁË ÄÁÌÅÅ.  ÷ÏÚÍÏÖÎÏ, ÎÁÉÌÕÞÛÅÅ ÉÓÐÏÌØÚÏ×ÁÎÉÅ
      ÐÏÌÉÔÉË ÜÔÏ ÓÏÞÅÔÁÎÉÅ ÉÈ ×ÍÅÓÔÅ ÐÕÔÅÍ ÚÁÇÒÕÚËÉ ÎÅÓËÏÌØËÉÈ ÍÏÄÕÌÅÊ
      ÏÄÎÏ×ÒÅÍÅÎÎÏ, ÄÌÑ ÓÏÚÄÁÎÉÑ ÍÎÏÇÏÓÌÏÊÎÏÊ ÚÁÝÉÝÅÎÎÏÊ ÓÒÅÄÙ.  ÷
      ÍÎÏÇÏÓÌÏÊÎÏÊ ÓÒÅÄÅ ÂÅÚÏÐÁÓÎÏÓÔÉ ÎÅÓËÏÌØËÏ ÐÏÌÉÔÉË ÏÂÅÓÐÅÞÉ×ÁÀÔ
      ËÏÎÔÒÏÌÉÒÕÅÍÏÓÔØ ÚÁÝÉÔÙ.  üÔÏ ÏÔÌÉÞÁÅÔÓÑ ÏÔ ÕÓÉÌÅÎÉÑ ÚÁÝÉÔÙ,
      ËÏÇÄÁ ÏÂÙÞÎÏ ÕÓÉÌÉ×ÁÀÔÓÑ ÜÌÅÍÅÎÔÙ ÓÉÓÔÅÍÙ, ÉÓÐÏÌØÚÕÅÍÏÊ ×
      ÏÐÒÅÄÅÌÅÎÎÙÈ ÃÅÌÑÈ.  åÄÉÎÓÔ×ÅÎÎÙÍ ÎÅÄÏÓÔÁÔËÏÍ Ñ×ÌÑÅÔÓÑ
      ÄÏÐÏÌÎÉÔÅÌØÎÁÑ ÁÄÍÉÎÉÓÔÒÁÔÉ×ÎÁÑ ÎÁÇÒÕÚËÁ × ÓÌÕÞÁÅ ÍÎÏÖÅÓÔ×ÅÎÎÙÈ
      ÍÅÔÏË ÆÁÊÌÏ×ÏÊ ÓÉÓÔÅÍÙ, ÕÓÔÁÎÏ×ËÉ ÓÅÔÅ×ÏÇÏ ÄÏÓÔÕÐÁ ÐÏ ÐÏÌØÚÏ×ÁÔÅÌÑÍ,
      É Ô.Ä.</para>

    <para>üÔÉ ÎÅÄÏÓÔÁÔËÉ ÍÉÎÉÍÁÌØÎÙ ÐÏ ÓÒÁ×ÎÅÎÉÀ Ó ÄÌÉÔÅÌØÎÙÍ ÜÆÆÅËÔÏÍ
      ÆÕÎËÃÉÏÎÉÒÏ×ÁÎÉÑ ÉÎÆÒÁÓÔÒÕËÔÕÒÙ; ÎÁÐÒÉÍÅÒ, ×ÏÚÍÏÖÎÏÓÔØ ×ÙÂÏÒÁ
      ÐÏÌÉÔÉË, ÎÅÏÂÈÏÄÉÍÙÈ ÄÌÑ ÏÐÒÅÄÅÌÅÎÎÙÈ ËÏÎÆÉÇÕÒÁÃÉÊ, ÕÍÅÎØÛÁÅÔ
      ÐÏÔÅÒÀ ÐÒÏÉÚ×ÏÄÉÔÅÌØÎÏÓÔÉ.  ÷ÏÚÍÏÖÎÏÓÔØ ÕÄÁÌÅÎÉÑ ÐÏÄÄÅÒÖËÉ ÎÅ
      ÉÓÐÏÌØÚÕÅÍÙÈ ÐÏÌÉÔÉË ÍÏÖÅÔ Õ×ÅÌÉÞÉÔØ ÏÂÝÕÀ ÐÒÏÉÚ×ÏÄÉÔÅÌØÎÏÓÔØ
      ÓÉÓÔÅÍÙ, Á ÔÁËÖÅ ÄÁÅÔ ÇÉÂËÏÓÔØ ×ÙÂÏÒÁ.  èÏÒÏÛÁÑ ÒÅÁÌÉÚÁÃÉÑ
      ÕÄÏ×ÌÅÔ×ÏÒÉÔ ÏÂÝÉÅ ÔÒÅÂÏ×ÁÎÉÑ ÂÅÚÏÐÁÓÎÏÓÔÉ É ÂÕÄÅÔ ÜÆÆÅËÔÉ×ÎÏ
      ÉÓÐÏÌØÚÏ×ÁÔØ ÒÁÚÌÉÞÎÙÅ ÐÏÌÉÔÉËÉ, ÐÒÅÄÏÓÔÁ×ÌÑÅÍÙÅ ÉÎÆÒÁÓÔÒÕËÔÕÒÏÊ.</para>

    <para>óÉÓÔÅÍÁ, ÉÓÐÏÌØÚÕÀÝÁÑ ×ÏÚÍÏÖÎÏÓÔÉ <acronym>MAC</acronym>,
      ÄÏÌÖÎÁ ËÁË ÍÉÎÉÍÕÍ ÇÁÒÁÎÔÉÒÏ×ÁÔØ, ÞÔÏ ÐÏÌØÚÏ×ÁÔÅÌÀ ÎÅ ÒÁÚÒÅÛÁÅÔÓÑ
      ÓÁÍÏÓÔÏÑÔÅÌØÎÏ ÉÚÍÅÎÑÔØ ÁÔÒÉÂÕÔÙ ÂÅÚÏÐÁÓÎÏÓÔÉ; ×ÓÅ ÕÔÉÌÉÔÙ
      ÐÏÌØÚÏ×ÁÔÅÌÑ, ÐÒÏÇÒÁÍÍÙ É ÓËÒÉÐÔÙ ÄÏÌÖÎÙ ÒÁÂÏÔÁÔØ Ó ÏÇÒÁÎÉÞÅÎÉÑÍÉ
      ÄÏÓÔÕÐÁ, ÎÁÌÁÇÁÅÍÙÍÉ ×ÙÂÒÁÎÎÏÊ ÐÏÌÉÔÉËÏÊ; ×ÅÓØ ËÏÎÔÒÏÌØ ÐÒÁ×ÉÌ
      ÄÏÓÔÕÐÁ <acronym>MAC</acronym> ÎÁÈÏÄÉÔÓÑ × ÒÕËÁÈ ÓÉÓÔÅÍÎÏÇÏ
      ÁÄÍÉÎÉÓÔÒÁÔÏÒÁ.</para>

    <para>ðÒÁ×Ï ×ÙÂÏÒÁ ÐÒÁ×ÉÌØÎÙÈ ÐÏÌÉÔÉË ÂÅÚÏÐÁÓÎÏÓÔÉ ÐÒÉÎÁÄÌÅÖÉÔ ÔÏÌØËÏ
      ÓÉÓÔÅÍÎÏÍÕ ÁÄÍÉÎÉÓÔÒÁÔÏÒÕ.  ÷ ÎÅËÏÔÏÒÙÈ ÓÌÕÞÁÑÈ ÍÏÖÅÔ ÐÏÔÒÅÂÏ×ÁÔØÓÑ
      ÏÇÒÁÎÉÞÅÎÉÅ ÄÏÓÔÕÐÁ ÞÅÒÅÚ ÓÅÔØ; ÄÌÑ ÜÔÏÇÏ ÍÏÇÕÔ ÐÒÉÇÏÄÉÔØÓÑ
      &man.mac.portacl.4;, &man.mac.ifoff.4; É ÄÁÖÅ &man.mac.biba.4;.
      ÷ ÄÒÕÇÉÈ ÓÌÕÞÁÑÈ ÍÏÖÅÔ ÂÙÔØ ÎÅÏÂÈÏÄÉÍÁ ÓÔÒÏÇÁÑ ËÏÎÆÉÄÅÎÃÉÁÌØÎÏÓÔØ
      ÏÂßÅËÔÏ× × ÆÁÊÌÏ×ÏÊ ÓÉÓÔÅÍÅ.
      äÌÑ ÜÔÏÇÏ ÓÕÝÅÓÔ×ÕÀÔ ÐÏÌÉÔÉËÉ &man.mac.bsdextended.4; É
      &man.mac.mls.4;.</para>

    <para>÷ÙÂÏÒ ÐÏÌÉÔÉËÉ ÍÏÖÅÔ ÂÙÔØ ÓÄÅÌÁÎ ÎÁ ÏÓÎÏ×Å ËÏÎÆÉÇÕÒÁÃÉÉ ÓÅÔÉ.
      ÷ÏÚÍÏÖÎÏ ÔÏÌØËÏ ÏÐÒÅÄÅÌÅÎÎÙÍ ÐÏÌØÚÏ×ÁÔÅÌÑÍ ÍÏÖÎÏ ÒÁÚÒÅÛÉÔØ ÄÏÓÔÕÐ
      ÞÅÒÅÚ &man.ssh.1; Ë ÓÅÔÉ ÉÌÉ ÉÎÔÅÒÎÅÔ.  ÷ ÔÁËÉÈ ÓÉÔÕÁÃÉÑÈ ÐÏÄÏÊÄÅÔ
      ÐÏÌÉÔÉËÁ &man.mac.portacl.4;.  îÏ ÞÔÏ ÎÅÏÂÈÏÄÉÍÏ ÓÄÅÌÁÔØ ÄÌÑ ÆÁÊÌÏ×ÙÈ
      ÓÉÓÔÅÍ?  äÏÌÖÅÎ ÌÉ ÄÏÓÔÕÐ Ë ÏÐÒÅÄÅÌÅÎÎÙÍ ËÁÔÁÌÏÇÁÍ ÂÙÔØ ÚÁÐÒÅÝÅÎ
      ÄÌÑ ÄÒÕÇÉÈ ÇÒÕÐÐ ÉÌÉ ÏÐÒÅÄÅÌÅÎÎÙÈ ÐÏÌØÚÏ×ÁÔÅÌÅÊ?  éÌÉ ÍÙ ÄÏÌÖÎÙ
      ÏÇÒÁÎÉÞÉÔØ ÄÏÓÔÕÐ ÐÏÌØÚÏ×ÁÔÅÌÅÊ ÉÌÉ ÕÔÉÌÉÔ Ë ÏÐÒÅÄÅÌÅÎÎÙÍ ÆÁÊÌÁÍ
      ÐÕÔÅÍ ËÌÁÓÓÉÆÉËÁÃÉÉ ÏÐÒÅÄÅÌÅÎÎÙÈ ÏÂßÅËÔÏ×?</para>

    <para>÷ ÓÌÕÞÁÅ ÆÁÊÌÏ×ÏÊ ÓÉÓÔÅÍÙ, ÄÏÓÔÕÐ ÍÏÖÅÔ ÓÞÉÔÁÔØÓÑ ËÏÎÆÉÄÅÎÃÉÁÌØÎÙÍ
      ÄÌÑ ÏÔÄÅÌØÎÙÈ ÐÏÌØÚÏ×ÁÔÅÌÅÊ, ÎÏ ÎÅ ÄÌÑ ×ÓÅÈ.  îÁÐÒÉÍÅÒ, ÂÏÌØÛÁÑ
      ËÏÍÁÎÄÁ ÒÁÚÒÁÂÏÔÞÉËÏ× ÍÏÖÅÔ ÂÙÔØ ÒÁÚÂÉÔÁ ÎÁ ÎÅÂÏÌØÛÉÅ ÇÒÕÐÐÙ.
      òÁÚÒÁÂÏÔÞÉËÁÍ ÐÒÏÅËÔÁ A ÍÏÖÅÔ ÂÙÔØ ÎÅ ÒÁÚÒÅÛÅÎ ÄÏÓÔÕÐ Ë ÏÂßÅËÔÁÍ,
      ÎÁÐÉÓÁÎÎÙÍ ÒÁÚÒÁÂÏÔÞÉËÁÍÉ ÉÚ ÐÒÏÅËÔÁ B.  èÏÔÑ ÉÍ ÍÏÖÅÔ ÐÏÎÁÄÏÂÉÔØÓÑ
      ÄÏÓÔÕÐ Ë ÏÂßÅËÔÁÍ, ÓÏÚÄÁÎÎÙÍ ÒÁÚÒÁÂÏÔÞÉËÁÍÉ ÐÒÏÅËÔÁ C;
      ÜÔÏ ÒÅÁÌØÎÏ ×ÓÔÒÅÞÁÀÝÁÑÓÑ ÓÉÔÕÁÃÉÑ.  ó ÐÏÍÏÝØÀ ÒÁÚÌÉÞÎÙÈ ÐÏÌÉÔÉË,
      ÐÒÅÄÏÓÔÁ×ÌÑÅÍÙÈ ÉÎÆÒÁÓÔÒÕËÔÕÒÏÊ <acronym>MAC</acronym>, ÐÏÌØÚÏ×ÁÔÅÌÉ
      ÍÏÇÕÔ ÂÙÔØ ÒÁÚÄÅÌÅÎÙ ÎÁ ÜÔÉ ÔÒÉ ÇÒÕÐÐÙ É ÚÁÔÅÍ ÐÏÌÕÞÉÔØ ÄÏÓÔÕÐ
      Ë ÓÏÏÔ×ÅÔÓÔ×ÕÀÝÉÍ ÏÂÌÁÓÔÑÍ ÂÅÚ ÏÐÁÓÎÏÓÔÉ ÕÔÅÞËÉ ÉÎÆÏÒÍÁÃÉÉ.</para>

    <para>ôÁËÉÍ ÏÂÒÁÚÏÍ, ËÁÖÄÁÑ ÐÏÌÉÔÉËÁ ÉÍÅÅÔ ÕÎÉËÁÌØÎÙÊ ÓÐÏÓÏÂ
      ×ÚÁÉÍÏÄÅÊÓÔ×ÉÑ Ó ÏÂÝÅÊ ÂÅÚÏÐÁÓÎÏÓÔØÀ ÓÉÓÔÅÍÙ.
      ÷ÙÂÏÒ ÐÏÌÉÔÉËÉ ÄÏÌÖÅÎ ÂÙÔØ ÏÓÎÏ×ÁÎ ÎÁ
      ÈÏÒÏÛÏ ÐÒÏÄÕÍÁÎÎÏÊ ÐÏÌÉÔÉËÅ ÂÅÚÏÐÁÓÎÏÓÔÉ.  ÷Ï ÍÎÏÇÉÈ ÓÌÕÞÁÑÈ ÐÏÌÉÔÉËÁ
      ÄÏÌÖÎÁ ÂÙÔØ ÐÏÌÎÏÓÔØÀ ÐÅÒÅÓÍÏÔÒÅÎÁ É ÒÅÁÌÉÚÏ×ÁÎÁ ÚÁÎÏ×Ï ÄÌÑ ×ÓÅÊ
      ÓÉÓÔÅÍÙ.  ðÏÎÉÍÁÎÉÅ ÒÁÚÌÉÞÎÙÈ ÐÏÌÉÔÉË, ÐÒÅÄÏÓÔÁ×ÌÑÅÍÙÈ ÉÎÆÒÁÓÔÒÕËÔÕÒÏÊ
      <acronym>MAC</acronym>, ÐÏÍÏÖÅÔ ÁÄÍÉÎÉÓÔÒÁÔÏÒÁÍ ×ÙÂÒÁÔØ ÌÕÞÛÕÀ ÐÏÌÉÔÉËÕ
      × Ó×ÏÅÊ ÓÉÔÕÁÃÉÉ.</para>

    <para>óÔÁÎÄÁÒÔÎÏÅ ÑÄÒÏ &os; ÎÅ ×ËÌÀÞÁÅÔ ÐÁÒÁÍÅÔÒ <acronym>MAC</acronym>;
      ÎÅÏÂÈÏÄÉÍÏ ÄÏÂÁ×ÉÔØ ÓÌÅÄÕÀÝÉÊ ÐÁÒÁÍÅÔÒ ÑÄÒÁ ÐÅÒÅÄ ÔÅÍ, ËÁË
      ÐÒÏÂÏ×ÁÔØ ËÁËÉÅ-ÌÉÂÏ ÉÚ ÐÒÉÍÅÒÏ× ÉÌÉ ÐÒÉÍÅÎÑÔØ ÉÎÆÏÒÍÁÃÉÀ ÜÔÏÊ
      ÇÌÁ×Ù:</para>

    <programlisting>options	MAC</programlisting>

    <para>úÁÔÅÍ ÎÅÏÂÈÏÄÉÍÏ ÐÅÒÅÓÏÂÒÁÔØ É ÐÅÒÅÕÓÔÁÎÏ×ÉÔØ ÑÄÒÏ.</para>

    <caution>
      <para>èÏÔÑ ÒÁÚÌÉÞÎÙÅ ÓÔÒÁÎÉÃÙ ÓÐÒÁ×ÏÞÎÉËÁ ÄÌÑ ÍÏÄÕÌÅÊ
	<acronym>MAC</acronym> ÓÏÏÂÝÁÀÔ, ÞÔÏ ÏÎÉ ÍÏÇÕÔ ÂÙÔØ ×ÓÔÒÏÅÎÙ × ÑÄÒÏ,
	×ÏÚÍÏÖÎÁ ÂÌÏËÉÒÏ×ËÁ ÄÏÓÔÕÐÁ ÓÉÓÔÅÍÙ Ë ÓÅÔÉ É ÄÒÕÇÉÅ ÐÏÂÏÞÎÙÅ ÜÆÆÅËÔÙ.
	÷ËÌÀÞÅÎÉÅ <acronym>MAC</acronym> ÏÞÅÎØ ÐÏÈÏÖÅ ÎÁ ×ËÌÀÞÅÎÉÅ
	ÂÒÁÎÄÍÁÕÜÒÁ, ÎÏ ÎÅÏÂÈÏÄÉÍÏ ÂÙÔØ ×ÎÉÍÁÔÅÌØÎÙÍ, ÞÔÏÂÙ ÐÏÌÎÏÓÔØÀ
	ÎÅ ÚÁÂÌÏËÉÒÏ×ÁÔØ ÓÉÓÔÅÍÕ.  îÅÏÂÈÏÄÉÍÏ ÐÒÅÄÕÓÍÏÔÒÅÔØ ×ÏÚÍÏÖÎÏÓÔØ
	×ÏÚ×ÒÁÔÁ Ë ÐÒÅÄÙÄÕÝÅÊ ËÏÎÆÉÇÕÒÁÃÉÉ, Á ÒÅÁÌÉÚÁÃÉÑ
	<acronym>MAC</acronym> ÕÄÁÌÅÎÎÏ ÄÏÌÖÎÁ ÐÒÏÉÚ×ÏÄÉÔØÓÑ Ó ÏÓÏÂÏÊ
	ÏÓÔÏÒÏÖÎÏÓÔØÀ.</para>
    </caution>
  </sect1>

  <sect1 id="mac-understandlabel">
    <title>íÅÔËÉ MAC</title>

    <para>íÅÔËÁ <acronym>MAC</acronym> ÜÔÏ ÁÔÒÉÂÕÔ ÂÅÚÏÐÁÓÎÏÓÔÉ,
      ËÏÔÏÒÙÊ ÍÏÖÅÔ ÂÙÔØ ÐÒÉÍÅÎÅÎ Ë ÓÕÂßÅËÔÁÍ
      É ÏÂßÅËÔÁÍ ×ÓÅÊ ÓÉÓÔÅÍÙ.</para>

    <para>ðÒÉ ÕÓÔÁÎÏ×ËÅ ÍÅÔËÉ ÐÏÌØÚÏ×ÁÔÅÌØ ÄÏÌÖÅÎ × ÔÏÞÎÏÓÔÉ ÐÏÎÉÍÁÔØ,
      ÞÔÏ ÉÍÅÎÎÏ ÏÎÁ ÄÅÌÁÅÔ.  áÔÒÉÂÕÔÙ, ÄÏÓÔÕÐÎÙÅ ÄÌÑ ÏÂßÅËÔÁ,
      ÚÁ×ÉÓÑÔ ÏÔ ÚÁÇÒÕÖÅÎÎÏÊ ÐÏÌÉÔÉËÉ, Á ÐÏÌÉÔÉËÉ ÉÎÔÅÒÐÒÅÔÉÒÕÀÔ
      Ó×ÏÉ ÁÔÒÉÂÕÔÙ ÓÏ×ÅÒÛÅÎÎÏ ÒÁÚÌÉÞÎÙÍ ÏÂÒÁÚÏÍ.  òÅÚÕÌØÔÁÔÏÍ
      ÎÅÄÏÓÔÁÔÏÞÎÏÇÏ ÐÏÎÉÍÁÎÉÑ ÎÁÓÔÒÏÅË ÍÏÖÅÔ ÓÔÁÔØ ÉÈ ÎÅÐÒÁ×ÉÌØÎÁÑ
      ÒÅÁÌÉÚÁÃÉÑ, ÞÔÏ ÍÏÖÅÔ ÐÒÉ×ÅÓÔÉ Ë ÎÅÏÖÉÄÁÎÎÏÍÕ, É ×ÏÚÍÏÖÎÏ
      ÎÅÖÅÌÁÔÅÌØÎÏÍÕ ÐÏ×ÅÄÅÎÉÀ ÓÉÓÔÅÍÙ.</para>

    <para>íÅÔËÁ ÂÅÚÏÐÁÓÎÏÓÔÉ ÎÁ ÏÂßÅËÔÅ ÉÓÐÏÌØÚÕÅÔÓÑ ÐÏÌÉÔÉËÏÊ
      ÄÌÑ ÏÐÒÅÄÅÌÅÎÉÑ ÐÒÁ×ÉÌ ÄÏÓÔÕÐÁ.  äÌÑ ÎÅËÏÔÏÒÙÈ ÐÏÌÉÔÉË ÍÅÔËÁ
      ÓÁÍÁ ÐÏ ÓÅÂÅ ÓÏÄÅÒÖÉÔ ×ÓÀ ÎÅÏÂÈÏÄÉÍÕÀ ÄÌÑ ÜÔÏÇÏ ÉÎÆÏÒÍÁÃÉÀ,
      × ÄÒÕÇÉÈ ÍÏÄÅÌÑÈ ÍÅÔËÉ ÍÏÇÕÔ ÏÂÒÁÂÁÔÙ×ÁÔØÓÑ ËÁË ÞÁÓÔØ
      ÂÏÌØÛÏÇÏ ÎÁÂÏÒÁ ÐÒÁ×ÉÌ, É Ô.Ä.</para>

    <para>îÁÐÒÉÍÅÒ, ÕÓÔÁÎÏ×ËÁ ÍÅÔËÉ × <literal>biba/low</literal>
      ÎÁ ÆÁÊÌÅ ÐÒÉÓ×ÏÉÔ ÜÔÏÍÕ ÆÁÊÌÕ ÍÅÔËÕ, ÏÂÒÁÂÁÔÙ×ÁÅÍÕÀ ÐÏÌÉÔÉËÏÊ
      Biba ÓÏ ÚÎÁÞÅÎÉÅÍ <quote>low</quote>.</para>

    <para>îÅÓËÏÌØËÏ ÐÏÌÉÔÉË, ÐÏÄÄÅÒÖÉ×ÁÀÝÉÈ ÍÅÔËÉ × &os;,
      ÐÒÅÄÏÓÔÁ×ÌÑÀÔ ÔÒÉ ÏÐÒÅÄÅÌÅÎÎÙÅ ÐÒÅÄÕÓÔÁÎÏ×ÌÅÎÎÙÅ ÍÅÔËÉ.
      üÔÏ ÎÉÚËÁÑ, ×ÙÓÏËÁÑ É ÒÁ×ÎÁÑ ÍÅÔËÉ.  èÏÔÑ ÏÎÉ ÕÓÔÁÎÁ×ÌÉ×ÁÀÔ ËÏÎÔÒÏÌØ
      ÒÁÚÌÉÞÎÙÍÉ ÓÐÏÓÏÂÁÍÉ ÄÌÑ ËÁÖÄÏÊ ÐÏÌÉÔÉËÉ, ×Ù ÍÏÖÅÔÅ ÂÙÔØ Õ×ÅÒÅÎÙ,
      ÞÔÏ ÎÉÚËÁÑ ÍÅÔËÁ ÚÁÄÁÓÔ ÍÉÎÉÍÁÌØÎÙÅ ÕÓÔÁÎÏ×ËÉ, ÒÁ×ÎÁÑ ÍÅÔËÁ
      ÏÚÎÁÞÁÅÔ ÏÔÍÅÎÕ ÉÌÉ ÎÅÄÅÊÓÔ×ÉÔÅÌØÎÏÓÔØ, Á ×ÙÓÏËÁÑ ÍÅÔËÁ ÕÓÔÁÎÏ×ÉÔ
      ÍÁËÓÉÍÁÌØÎÏ ×ÏÚÍÏÖÎÙÅ ÎÁÓÔÒÏÊËÉ × ÐÏÌÉÔÉËÁÈ Biba É
      <acronym>MLS</acronym>.</para>

    <para>ðÒÉ ÐÒÉÍÅÎÅÎÉÉ × ÆÁÊÌÏ×ÏÊ ÓÉÓÔÅÍÅ ÏÄÉÎÏÞÎÏÊ ÍÅÔËÉ, ÔÏÌØËÏ ÏÄÎÁ
      ÍÅÔËÁ ÍÏÖÅÔ ÂÙÔØ ÉÓÐÏÌØÚÏ×ÁÎÁ ÄÌÑ ÏÂßÅËÔÏ×.  üÔÏ ×ÙÚÏ×ÅÔ ÕÓÔÁÎÏ×ËÕ
      ÏÄÎÉÈ É ÔÅÈ ÖÅ ÐÒÁ× ÄÏÓÔÕÐÁ ÄÌÑ ×ÓÅÊ ÓÉÓÔÅÍÙ, É ×Ï ÍÎÏÇÉÈ ÓÌÕÞÁÑÈ
      ÜÔÏ ×ÓÅ, ÞÔÏ ÎÅÏÂÈÏÄÉÍÏ.  ôÅÍ ÎÅ ÍÅÎÅÅ, ÓÕÝÅÓÔ×ÕÅÔ ÎÅÓËÏÌØËÏ ÓÉÔÕÁÃÉÊ,
      × ËÏÔÏÒÙÈ ÎÁ ÏÂßÅËÔÙ É ÓÕÂßÅËÔÙ ÆÁÊÌÏ×ÏÊ ÓÉÓÔÅÍÙ ÍÏÇÕÔ ÂÙÔØ ÕÓÔÁÎÏ×ÌÅÎÙ
      ÍÎÏÖÅÓÔ×ÅÎÎÙÅ ÍÅÔËÉ.  ÷ ÜÔÉÈ ÓÉÔÕÁÃÉÑÈ ÎÅÏÂÈÏÄÉÍÏ Ó ÐÏÍÏÝØÀ
      &man.tunefs.8; ÕÓÔÁÎÏ×ÉÔØ ÐÁÒÁÍÅÔÒ <option>multilabel</option>.</para>

    <para>÷ ÓÌÕÞÁÅ Biba É <acronym>MLS</acronym> ÍÏÖÅÔ ÂÙÔØ ÕÓÔÁÎÏ×ÌÅÎÁ
      ÞÉÓÌÏ×ÁÑ ÍÅÔËÁ
      ÄÌÑ ÕËÁÚÁÎÉÑ ÔÏÞÎÏÇÏ ÕÒÏ×ÎÑ ÉÅÒÁÒÈÉÞÅÓËÏÇÏ ËÏÎÔÒÏÌÑ.  üÔÏÔ ÞÉÓÌÏ×ÏÊ
      ÕÒÏ×ÅÎØ ÉÓÐÏÌØÚÕÅÔÓÑ ÄÌÑ ÒÁÚÄÅÌÅÎÉÑ ÉÌÉ ÓÏÒÔÉÒÏ×ËÉ ÉÎÆÏÒÍÁÃÉÉ
      ÐÏ ÒÁÚÌÉÞÎÙÍ ÇÒÕÐÐÁÍ ËÌÁÓÓÉÆÉËÁÃÉÉ, ÒÁÚÒÅÛÁÀÝÅÊ ÄÏÓÔÕÐ ÔÏÌØËÏ Ë
      ÜÔÏÊ ÇÒÕÐÐÅ ÉÌÉ ÇÒÕÐÐÅ Ó ÂÏÌÅÅ ×ÙÓÏËÉÍ ÕÒÏ×ÎÅÍ.</para>

    <para>÷ ÂÏÌØÛÉÎÓÔ×Å ÓÌÕÞÁÅ× ÓÉÓÔÅÍÎÙÊ ÁÄÍÉÎÉÓÔÒÁÔÏÒ ÉÓÐÏÌØÚÕÅÔ ÔÏÌØËÏ
      ÏÄÎÕ ÍÅÔËÕ ÎÁ ×ÓÀ ÆÁÊÌÏ×ÕÀ ÓÉÓÔÅÍÕ.</para>

    <para><emphasis>ðÏÓÔÏÊÔÅ, ÎÏ ÜÔÏ ÖÅ ÐÏÈÏÖÅ ÎÁ <acronym>DAC</acronym>!
      ñ ÄÕÍÁÌ, ÞÔÏ <acronym>MAC</acronym> ÄÁÅÔ ËÏÎÔÒÏÌØ ÔÏÌØËÏ
      ÁÄÍÉÎÉÓÔÒÁÔÏÒÕ.</emphasis>  üÔÏ ÕÔ×ÅÒÖÄÅÎÉÅ ×ÓÅ ÅÝÅ ×ÅÒÎÏ,
      ÔÏÌØËÏ <username>root</username> ËÏÎÔÒÏÌÉÒÕÅÔ É ÎÁÓÔÒÁÉ×ÁÅÔ
      ÐÏÌÉÔÉËÉ, ÔÁË ÞÔÏ ÐÏÌØÚÏ×ÁÔÅÌÉ ÐÏÍÅÝÁÀÔÓÑ × ÓÏÏÔ×ÅÔÓÔ×ÕÀÝÉÅ
      ËÁÔÅÇÏÒÉÉ/ÕÒÏ×ÎÉ ÄÏÓÔÕÐÁ.  íÎÏÇÉÅ ÐÏÌÉÔÉËÉ ÍÏÇÕÔ ÏÇÒÁÎÉÞÉÔØ ÔÁËÖÅ
      É ÐÏÌØÚÏ×ÁÔÅÌÑ <username>root</username>.
      âÁÚÏ×ÙÊ ËÏÎÔÒÏÌØ ÎÁÄ ÏÂßÅËÔÁÍÉ ÚÁÔÅÍ
      ÐÅÒÅÄÁÅÔÓÑ ÇÒÕÐÐÅ, ÎÏ ÐÏÌØÚÏ×ÁÔÅÌØ <username>root</username>
      ÍÏÖÅÔ ÏÔÍÅÎÉÔØ ÉÌÉ ÉÚÍÅÎÉÔØ ÜÔÉ ÎÁÓÔÒÏÊËÉ × ÌÀÂÏÅ ×ÒÅÍÑ.
      äÁÎÎÁÑ ÉÅÒÁÒÈÉÞÅÓËÁÑ <!-- /clearance --> ÍÏÄÅÌØ ÓÏÏÔ×ÅÔÓÔ×ÕÅÔ
      ÔÁËÉÍ ÐÏÌÉÔÉËÁÍ ËÁË Biba É <acronym>MLS</acronym>.</para>

    <sect2>
      <title>îÁÓÔÒÏÊËÁ ÍÅÔÏË</title>

      <para>ðÒÁËÔÉÞÅÓËÉ ×ÓÅ ÄÅÊÓÔ×ÉÑ ÐÏ ÎÁÓÔÒÏÊËÅ ÐÏÌÉÔÉËÉ Ó ÍÅÔËÁÍÉ
	ÍÏÇÕÔ ÂÙÔØ ×ÙÐÏÌÎÅÎÙ Ó ÉÓÐÏÌØÚÏ×ÁÎÉÅÍ ÕÔÉÌÉÔ ÂÁÚÏ×ÏÊ ÓÉÓÔÅÍÙ.
	üÔÉ ËÏÍÁÎÄÙ ÏÂÅÓÐÅÞÉ×ÁÀÔ ÐÒÏÓÔÏÊ ÉÎÔÅÒÆÅÊÓ ÄÌÑ ÎÁÓÔÒÏÊËÉ
	ÏÂßÅËÔÏ× ÉÌÉ ÓÕÂßÅËÔÏ×, ÉÌÉ ÄÌÑ ÉÚÍÅÎÅÎÉÑ É ÐÒÏ×ÅÒËÉ
	ÎÁÓÔÒÏÅË.</para>

      <para>÷ÓÅ ÎÁÓÔÒÏÊËÉ ÍÏÇÕÔ ÂÙÔØ ×ÙÐÏÌÎÅÎÙ Ó ÉÓÐÏÌØÚÏ×ÁÎÉÅÍ ÕÔÉÌÉÔ
	&man.setfmac.8; É &man.setpmac.8;.  ëÏÍÁÎÄÁ
	<command>setfmac</command> ÉÓÐÏÌØÚÕÅÔÓÑ ÄÌÑ ÕÓÔÁÎÏ×ËÉ ÍÅÔÏË
	<acronym>MAC</acronym> ÎÁ ÓÉÓÔÅÍÎÙÅ ÏÂßÅËÔÙ, Á ËÏÍÁÎÄÁ
	<command>setpmac</command> ÉÓÐÏÌØÚÕÅÔÓÑ ÄÌÑ ÕÓÔÁÎÏ×ËÉ ÍÅÔÏË ÎÁ
	ÓÉÓÔÅÍÎÙÅ ÓÕÂßÅËÔÙ.  ÷ÙÐÏÌÎÉÔÅ:</para>

      <screen>&prompt.root; <userinput>setfmac biba/high test</userinput></screen>

      <para>åÓÌÉ ÎÅ ÐÒÏÉÚÏÊÄÅÔ ÏÛÉÂÏË, ÂÕÄÅÔ ×ÏÚ×ÒÁÝÅÎÏ ÐÒÉÇÌÁÛÅÎÉÅ ËÏÍÁÎÄÎÏÊ
	ÓÔÒÏËÉ, ËÁË É ÐÏÓÌÅ ËÏÍÁÎÄ &man.chmod.1; É &man.chown.8;.
	÷ ÎÅËÏÔÏÒÙÈ ÓÌÕÞÁÑÈ ÍÏÖÅÔ ÐÏÑ×ÉÔØÓÑ ÏÛÉÂËÁ
	<errorname>Permission denied</errorname>, É ÏÎÁ ÏÂÙÞÎÏ ÐÏÑ×ÌÑÅÔÓÑ ÐÒÉ
	ÕÓÔÁÎÏ×ËÅ ÉÌÉ ÉÚÍÅÎÅÎÉÉ ÍÅÔËÉ ÎÁ ÏÂßÅËÔ Ó ÏÇÒÁÎÉÞÅÎÉÑÍÉ.
	<footnote><para>åÓÔØ É ÄÒÕÇÉÅ ÓÉÔÕÁÃÉÉ, × ËÏÔÏÒÙÈ ÍÏÇÕÔ ×ÏÚÎÉËÁÔØ
	ÒÁÚÌÉÞÎÙÅ ÏÛÉÂËÉ.  îÁÐÒÉÍÅÒ, ÆÁÊÌ ÍÏÖÅÔ ÎÅ ÎÁÈÏÄÉÔØÓÑ ×Ï ×ÌÁÄÅÎÉÉ
	ÐÏÌØÚÏ×ÁÔÅÌÑ, ÐÙÔÁÀÝÅÇÏÓÑ ÉÚÍÅÎÉÔØ ÍÅÔËÕ ÎÁ ÏÂßÅËÔÅ, ÏÂßÅËÔ ÍÏÖÅÔ
	ÎÅ ÓÕÝÅÓÔ×Ï×ÁÔØ ÉÌÉ ÓÕÝÅÓÔ×Ï×ÁÔØ ÔÏÌØËÏ ÄÌÑ ÞÔÅÎÉÑ.  ðÏÌÉÔÉËÁ ÍÏÖÅÔ
	ÎÅ ÐÏÚ×ÏÌÉÔØ ÐÒÏÃÅÓÓÕ ÉÚÍÅÎÉÔØ ÍÅÔËÕ ÎÁ ÆÁÊÌ, ×ÏÚÍÏÖÎÏ × Ó×ÑÚÉ ÓÏ
	Ó×ÏÊÓÔ×ÁÍÉ ÆÁÊÌÁ, ÐÒÏÃÅÓÓÁ, ÉÌÉ ÎÏ×ÏÇÏ ÚÎÁÞÅÎÉÑ ÍÅÔËÉ.  îÁÐÒÉÍÅÒ:
	ÐÏÌØÚÏ×ÁÔÅÌØ Ó ÎÉÚËÉÍ ÕÒÏ×ÎÅÍ ÄÏ×ÅÒÉÑ ÐÙÔÁÅÔÓÑ ÉÚÍÅÎÉÔØ ÍÅÔËÕ ÎÁ
	ÆÁÊÌÅ Ó ×ÙÓÏËÉÍ ÕÒÏ×ÎÅÍ ÄÏ×ÅÒÉÑ.  éÌÉ ÐÏÌØÚÏ×ÁÔÅÌØ Ó ÎÉÚËÉÍ ÕÒÏ×ÎÅÍ
	ÄÏ×ÅÒÉÑ ÐÙÔÁÅÔÓÑ ÉÚÍÅÎÉÔØ ÍÅÔËÕ ÆÁÊÌÁ Ó ÎÉÚËÉÍ ÕÒÏ×ÎÅÍ ÄÏ×ÅÒÉÑ ÎÁ
	ÍÅÔËÕ ×ÙÓÏËÏÇÏ ÕÒÏ×ÎÑ.</para></footnote>
	óÉÓÔÅÍÎÙÊ ÁÄÍÉÎÉÓÔÒÁÔÏÒ ÄÌÑ ÏÂÈÏÄÁ ÜÔÏÊ ÐÒÏÂÌÅÍÙ ÍÏÖÅÔ ÉÓÐÏÌØÚÏ×ÁÔØ
	ÓÌÅÄÕÀÝÉÅ ËÏÍÁÎÄÙ:</para>

      <screen>&prompt.root; <userinput>setfmac biba/high test</userinput>
<errorname>Permission denied</errorname>
&prompt.root; <userinput>setpmac biba/low setfmac biba/high test</userinput>
&prompt.root; <userinput>getfmac test</userinput>
test: biba/high</screen>

      <para>ëÁË ×ÉÄÎÏ ÉÚ ÐÒÉÍÅÒÁ ×ÙÛÅ, ËÏÍÁÎÄÁ <command>setpmac</command>
	ÍÏÖÅÔ ÂÙÔØ
	ÉÓÐÏÌØÚÏ×ÁÎÁ ÄÌÑ ÉÚÍÅÎÅÎÉÑ ÕÓÔÁÎÏ×ÏË ÐÏÌÉÔÉËÉ ÐÕÔÅÍ ÐÒÉÓ×ÏÅÎÉÑ
	ÉÎÏÊ ÍÅÔËÉ ×ÙÚÙ×ÁÀÝÅÍÕ ÐÒÏÃÅÓÓÕ.  õÔÉÌÉÔÁ <command>getpmac</command>
	ÏÂÙÞÎÏ ÉÓÐÏÌØÚÕÅÔÓÑ Ó ÓÕÝÅÓÔ×ÕÀÝÉÍ ÎÁ ÄÁÎÎÙÊ ÍÏÍÅÎÔ ÐÒÏÃÅÓÓÏÍ,
	ÔÁËÉÍ ËÁË <application>sendmail</application>, ÈÏÔÑ ÏÎÁ ÐÒÉÎÉÍÁÅÔ
	PID ×ÍÅÓÔÏ ËÏÍÁÎÄÙ, ÅÅ ÄÅÊÓÔ×ÉÅ ÁÎÁÌÏÇÉÞÎÏ.  åÓÌÉ ÐÏÌØÚÏ×ÁÔÅÌÉ
	ÐÏÐÙÔÁÀÔÓÑ ÍÁÎÉÐÕÌÉÒÏ×ÁÔØ ÆÁÊÌÁÍÉ, Ë ËÏÔÏÒÙÍ Õ ÎÉÈ ÎÅÔ ÄÏÓÔÕÐÁ
	× ÓÏÏÔ×ÅÔÓÔ×ÉÉ Ó ÐÒÁ×ÉÌÁÍÉ ÚÁÇÒÕÖÅÎÎÙÈ ÐÏÌÉÔÉË,
	ÆÕÎËÃÉÅÊ <function>mac_set_link</function> ÂÕÄÅÔ
	×ÙÄÁÎÏ ÓÏÏÂÝÅÎÉÅ ÏÂ ÏÛÉÂËÅ <errorname>Operation not
	permitted</errorname>.</para>

      <sect3>
	<title>ðÏÌØÚÏ×ÁÔÅÌÉ É ÕÓÔÁÎÏ×ËÉ ÍÅÔÏË</title>

	<para>ðÏÌØÚÏ×ÁÔÅÌÑÍ ÎÅÏÂÈÏÄÉÍÏ ÉÍÅÔØ ÍÅÔËÉ, ÞÔÏÂÙ ÉÈ ÆÁÊÌÙ É
	  ÐÒÏÃÅÓÓÙ ÍÏÇÌÉ ÐÒÁ×ÉÌØÎÏ ×ÚÁÉÍÏÄÅÊÓÔ×Ï×ÁÔØ Ó ÏÐÒÅÄÅÌÅÎÎÏÊ
	  × ÓÉÓÔÅÍÅ ÐÏÌÉÔÉËÏÊ ÂÅÚÏÐÁÓÎÏÓÔÉ.  üÔÏ ÎÁÓÔÒÁÉ×ÁÅÔÓÑ
	  ÞÅÒÅÚ ÆÁÊÌ <filename>login.conf</filename> ÐÕÔÅÍ ÉÓÐÏÌØÚÏ×ÁÎÉÑ
	  ËÌÁÓÓÏ×.  ëÁÖÄÁÑ ÐÏÌÉÔÉËÁ, ÉÓÐÏÌØÚÕÀÝÁÑ ÍÅÔËÉ, ÒÅÁÌÉÚÕÅÔ ÕÓÔÁÎÏ×ËÕ
	  ËÌÁÓÓÁ ÐÏÌØÚÏ×ÁÔÅÌÑ.</para>

	<para>ðÒÉÍÅÒ ÚÁÐÉÓÉ, ÓÏÄÅÒÖÁÝÅÊ ×ÓÅ ÐÏÌÉÔÉËÉ, ÐÒÉ×ÅÄÅÎÎÙÅ
	  ÎÉÖÅ:</para>

	<programlisting>default:\
	:copyright=/etc/COPYRIGHT:\
	:welcome=/etc/motd:\
	:setenv=MAIL=/var/mail/$,BLOCKSIZE=K:\
	:path=~/bin:/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin:\
	:manpath=/usr/share/man /usr/local/man:\
	:nologin=/usr/sbin/nologin:\
	:cputime=1h30m:\
	:datasize=8M:\
	:vmemoryuse=100M:\
	:stacksize=2M:\
	:memorylocked=4M:\
	:memoryuse=8M:\
	:filesize=8M:\
	:coredumpsize=8M:\
	:openfiles=24:\
	:maxproc=32:\
	:priority=0:\
	:requirehome:\
	:passwordtime=91d:\
	:umask=022:\
	:ignoretime@:\
	:label=partition/13,mls/5,biba/10(5-15),lomac10[2]:</programlisting>

	<para>ðÁÒÁÍÅÔÒ <literal>label</literal> ÉÓÐÏÌØÚÕÅÔÓÑ ÄÌÑ ÕÓÔÁÎÏ×ËÉ
	  ÍÅÔËÉ <acronym>MAC</acronym> ÐÏ ÕÍÏÌÞÁÎÉÀ ÄÌÑ ËÌÁÓÓÁ ÐÏÌØÚÏ×ÁÔÅÌÑ.
	  ðÏÌØÚÏ×ÁÔÅÌÉ ÎÅ ÓÍÏÇÕÔ ÉÚÍÅÎÑÔØ ÜÔÏ ÚÎÁÞÅÎÉÅ, ÐÏÜÔÏÍÕ ÅÇÏ
	  ÍÏÖÎÏ ÐÒÉÚÎÁÔØ ÎÅ ÏÐÃÉÏÎÁÌØÎÙÍ.  ÷ ÒÅÁÌØÎÏÊ ÓÉÔÕÁÃÉÉ ÁÄÍÉÎÉÓÔÒÁÔÏÒÕ
	  ÎÉËÏÇÄÁ ÎÅ ÐÏÔÒÅÂÕÅÔÓÑ ×ËÌÀÞÁÔØ ËÁÖÄÕÀ ÐÏÌÉÔÉËÕ.
	  òÅËÏÍÅÎÄÕÅÔÓÑ ÐÒÏÞÅÓÔØ ÇÌÁ×Õ ÐÏÌÎÏÓÔØÀ ÐÅÒÅÄ ÒÅÁÌÉÚÁÃÉÅÊ ÌÀÂÏÊ
	  ÉÚ ÜÔÉÈ ÎÁÓÔÒÏÅË.</para>

	<note>
	  <para>ðÏÌØÚÏ×ÁÔÅÌÉ ÍÏÇÕÔ ÉÚÍÅÎÉÔØ Ó×ÏÀ ÍÅÔËÕ ÐÏÓÌÅ ×ÈÏÄÁ;
	    ÏÄÎÁËÏ ÐÏÌÉÔÉËÁ ÎÁËÌÁÄÙ×ÁÅÔ ÏÇÒÁÎÉÞÅÎÉÅ ÎÁ ÜÔÏ ÉÚÍÅÎÅÎÉÅ.
	    ÷ ÐÒÉÍÅÒÅ ×ÙÛÅ ÐÏÌÉÔÉËÅ Biba ÕËÁÚÁÎÏ, ÞÔÏ ÍÉÎÉÍÁÌØÎÁÑ
	    ÃÅÌÏÓÔÎÏÓÔØ ÐÒÏÃÅÓÓÁ 5, ÍÁËÓÉÍÁÌØÎÁÑ 15, Á ÜÆÆÅËÔÉ×ÎÁÑ
	    ÃÅÌÏÓÔÎÏÓÔØ ÐÏ ÕÍÏÌÞÁÎÉÀ 10.  ðÒÏÃÅÓÓ ÂÕÄÅÔ ÒÁÂÏÔÁÔØ ÎÁ
	    ÕÒÏ×ÎÅ 10, ÐÏËÁ ÍÅÔËÁ ÎÅ ÂÕÄÅÔ ÉÚÍÅÎÅÎÁ, ÎÁÐÒÉÍÅÒ ÅÓÌÉ
	    ÐÏÌØÚÏ×ÁÔÅÌØ ÉÓÐÏÌØÚÕÅÔ ËÏÍÁÎÄÕ setpmac, ËÏÔÏÒÕÀ Biba
	    ÏÇÒÁÎÉÞÉÔ ÄÉÁÐÁÚÏÎÏÍ, ÕÓÔÁÎÏ×ÌÅÎÎÙÍ ÐÒÉ ×ÈÏÄÅ.</para>
	</note>

	<para>÷Ï ×ÓÅÈ ÓÌÕÞÁÑÈ ÐÏÓÌÅ ÉÚÍÅÎÅÎÉÑ
	  <filename>login.conf</filename>, ÂÁÚÁ ÄÁÎÎÙÈ
	  <quote>login class capability</quote> ÄÏÌÖÎÁ ÂÙÔØ ÐÅÒÅÓÏÂÒÁÎÁ
	  Ó ÉÓÐÏÌØÚÏ×ÁÎÉÅÍ ËÏÍÁÎÄÙ <command>cap_mkdb</command>
	  É ÜÔÏ ÂÕÄÅÔ ÏÔÒÁÖÅÎÏ × ËÁÖÄÏÍ ÐÏÓÌÅÄÕÀÝÅÍ ÐÒÉÍÅÒÅ ÇÌÁ×Ù.</para>

	<para>ðÏÌÅÚÎÏ ÏÔÍÅÔÉÔØ, ÞÔÏ ËÏÌÉÞÅÓÔ×Ï ÐÏÌØÚÏ×ÁÔÅÌÅÊ, ËÏÔÏÒÙÍ
	  ÔÒÅÂÕÀÔÓÑ ÒÁÚÌÉÞÎÙÅ ËÌÁÓÓÙ, ×Ï ÍÎÏÇÉÈ ÓÅÔÑÈ ÍÏÖÅÔ ÂÙÔØ ×ÅÌÉËÏ.
	  îÅÏÂÈÏÄÉÍÏ ÔÝÁÔÅÌØÎÏÅ ÐÌÁÎÉÒÏ×ÁÎÉÅ, ÐÏÓËÏÌØËÕ ÕÐÒÁ×ÌÅÎÉÅ ÔÁËÏÊ
	  ÓÅÔØÀ ÍÏÖÅÔ ÓÅÒØÅÚÎÏ ÕÓÌÏÖÎÉÔØÓÑ.</para>

	<para>÷ ÂÕÄÕÝÉÈ ×ÅÒÓÉÑÈ &os; ÐÏÑ×ÉÔÓÑ ÎÏ×ÙÊ ÓÐÏÓÏ Ó×ÑÚÙ×ÁÎÉÑ
	  ÐÏÌØÚÏ×ÁÔÅÌÅÊ Ó ÍÅÔËÁÍÉ; ÏÄÎÁËÏ, ÏÎ ÂÕÄÅÔ ÄÏÓÔÕÐÅÎ ÔÏÌØËÏ ÞÅÒÅÚ
	  ÎÅËÏÔÏÒÏÅ ×ÒÅÍÑ ÐÏÓÌÅ ×ÙÈÏÄÁ &os;&nbsp;5.3.</para>
      </sect3>

      <sect3>
	<title>óÅÔÅ×ÙÅ ÉÎÔÅÒÆÅÊÓÙ É ÕÓÔÁÎÏ×ËÁ ÍÅÔÏË</title>

	<para>íÅÔËÉ ÔÁËÖÅ ÍÏÇÕÔ ÂÙÔØ ÕÓÔÁÎÏ×ÌÅÎÙ ÎÁ ÓÅÔÅ×ÙÅ ÉÎÔÅÒÆÅÊÓÙ,
	  ÄÌÑ ËÏÎÔÒÏÌÑ ÐÏÔÏËÁ ÄÁÎÎÙÈ × ÓÅÔÉ. ÷Ï ×ÓÅÈ ÓÌÕÞÁÑÈ ÏÎÉ
	  ÆÕÎËÃÉÏÎÉÒÕÀÔ ÁÎÁÌÏÇÉÞÎÏ ÔÏÍÕ, ËÁË ÐÏÌÉÔÉËÉ ÐÏ ÏÔÎÏÛÅÎÉÀ Ë
	  ÏÂßÅËÔÁÍ.  ðÏÌØÚÏ×ÁÔÅÌÉ Ó ×ÙÓÏËÉÍÉ ÕÓÔÁÎÏ×ËÁÍÉ, ÎÁÐÒÉÍÅÒ,
	  <literal>biba</literal>, ÎÅ ÓÍÏÇÕÔ ÐÏÌÕÞÉÔØ ÄÏÓÔÕÐ Ë ÓÅÔÅ×ÙÍ
	  ÉÎÔÅÒÆÅÊÓÁÍ Ó ÎÉÚËÉÍÉ ÕÓÔÁÎÏ×ËÁÍÉ.</para>

	<para>äÌÑ ÕÓÔÁÎÏ×ËÉ <acronym>MAC</acronym> ÍÅÔÏË ÎÁ ÓÅÔÅ×ÙÈ
	  ÉÎÔÅÒÆÅÊÓÁÈ ÐÁÒÁÍÅÔÒ <option>maclabel</option> ÍÏÖÅÔ ÂÙÔØ ÐÅÒÅÄÁÎ
	  <command>ifconfig</command>.  îÁÐÒÉÍÅÒ:</para>

	<screen>&prompt.root; <userinput>ifconfig bge0 maclabel biba/equal</userinput></screen>

	<para>ÕÓÔÁÎÏ×ÉÔ <acronym>MAC</acronym> ÍÅÔËÕ
	  <literal>biba/equal</literal> ÎÁ ÉÎÔÅÒÆÅÊÓ &man.bge.4;.
	  ðÒÉ ÉÓÐÏÌØÚÏ×ÁÎÉÉ ÍÅÔËÉ, ÐÏÄÏÂÎÏÊ
	  <literal>biba/high(low-high)</literal> ×ÓÑ ÍÅÔËÁ ÄÏÌÖÎÁ ÂÙÔØ
	  ×ÚÑÔÁ × ËÁ×ÙÞËÉ, ÉÎÁÞÅ ÂÕÄÅÔ ×ÙÄÁÎÏ ÓÏÏÂÝÅÎÉÅ Ï ÏÛÉÂËÅ.</para>

	<para>ëÁÖÄÁÑ ÐÏÌÉÔÉËÁ, ÉÓÐÏÌØÚÕÀÝÁÑ ÍÅÔËÉ, ÓÎÁÂÖÅÎÁ ÐÅÒÅÍÅÎÎÏÊ
	  <command>sysctl</command>, ËÏÔÏÒÁÑ ÍÏÖÅÔ ÂÙÔØ ÉÓÐÏÌØÚÏ×ÁÎÁ ÄÌÑ
	  ÏÔËÌÀÞÅÎÉÑ <acronym>MAC</acronym> ÍÅÔÏË ÎÁ ÓÅÔÅ×ÙÈ ÉÎÔÅÒÆÅÊÓÁÈ.
	  õÓÔÁÎÏ×ËÁ ÍÅÔËÉ × <option>equal</option> ÂÕÄÅÔ ÉÍÅÔØ ÐÏÄÏÂÎÙÊ
	  ÜÆÆÅËÔ.  ðÒÏÓÍÏÔÒÉÔÅ ×Ù×ÏÄ ËÏÍÁÎÄÙ <command>sysctl</command>,
	  ÓÔÒÁÎÉÃÙ ÓÐÒÁ×ÏÞÎÉËÁ ÄÌÑ ÐÏÌÉÔÉË, ÉÌÉ ÄÁÌØÎÅÊÛÕÀ ÉÎÆÏÒÍÁÃÉÀ ÉÚ
	  ÜÔÏÊ ÇÌÁ×Ù ÐÏ ÜÔÉÍ ÐÅÒÅÍÅÎÎÙÍ.</para>
      </sect3>
    </sect2>

    <sect2>
      <title>ïÄÉÎÏÞÎÙÅ ÉÌÉ ÍÎÏÖÅÓÔ×ÅÎÎÙÅ ÍÅÔËÉ?</title>

      <para>ðÏ ÕÍÏÌÞÁÎÉÀ ÓÉÓÔÅÍÁ ÂÕÄÅÔ ÉÓÐÏÌØÚÏ×ÁÔØ ÐÁÒÁÍÅÔÒ
	<option>singlelabel</option>.  îÏ ÞÔÏ ÜÔÏ ÏÚÎÁÞÁÅÔ ÄÌÑ
	ÁÄÍÉÎÉÓÔÒÁÔÏÒÁ?  óÕÝÅÓÔ×ÕÀÔ ÎÅÓËÏÌØËÏ ÒÁÚÌÉÞÉÊ ÍÅÖÄÕ ÐÏÌÉÔÉËÁÍÉ,
	ËÁÖÄÁÑ ÉÚ ËÏÔÏÒÙÈ ÐÒÁ×ÉÌØÎÁ ÓÁÍÁ ÐÏ ÓÅÂÅ, ÎÏ ÉÍÅÅÔ Ó×ÏÉ ÄÏ×ÏÄÙ
	ÚÁ É ÐÒÏÔÉ× ÏÔÎÏÓÉÔÅÌØÎÏ ÇÉÂËÏÓÔÉ ÍÏÄÅÌÉ ÂÅÚÏÐÁÓÎÏÓÔÉ
	ÓÉÓÔÅÍÙ.</para>

      <para><option>singlelabel</option> (ÏÄÉÎÏÞÎÁÑ ÍÅÔËÁ) ÒÁÚÒÅÛÁÅÔ
	ÉÓÐÏÌØÚÏ×ÁÎÉÅ ÔÏÌØËÏ ÏÄÎÏÊ ÍÅÔËÉ, ÎÁÐÒÉÍÅÒ
	<literal>biba/high</literal>, ÄÌÑ ËÁÖÄÏÇÏ ÏÂßÅËÔÁ ÉÌÉ ÓÕÂßÅËÔÁ.
	åÅ ÐÒÅÉÍÕÝÅÓÔ×Ï × ÍÅÎØÛÅÊ ÎÁÇÒÕÚËÅ ÎÁ ÓÉÓÔÅÍÎÏÇÏ ÁÄÍÉÎÉÓÔÒÁÔÏÒÁ,
	Á ÎÅÄÏÓÔÁÔÏË × ÍÁÌÏÊ ÇÉÂËÏÓÔÉ ÐÏÌÉÔÉË, ÐÏÄÄÅÒÖÉ×ÁÀÝÉÈ ÍÅÔËÉ.
	íÎÏÇÉÅ ÁÄÍÉÎÉÓÔÒÁÔÏÒÙ × Ó×ÏÉÈ ÐÏÌÉÔÉËÁÈ ÂÅÚÏÐÁÓÎÏÓÔÉ ÍÏÇÕÔ
	ÐÒÅÄÐÏÞÅÓÔØ ÉÓÐÏÌØÚÏ×ÁÎÉÅ ÐÁÒÁÍÅÔÒÁ
	<option>multilabel</option>.</para>

      <para>ó ÐÁÒÁÍÅÔÒÏÍ <option>multilabel</option> ËÁÖÄÙÊ ÓÕÂßÅËÔ ÉÌÉ
	ÏÂßÅËÔ ÍÏÖÅÔ ÉÍÅÔØ ÓÏÂÓÔ×ÅÎÎÕÀ ÍÅÔËÕ <acronym>MAC</acronym>,
	× ÔÏ ×ÒÅÍÑ ËÁË ÓÏ ÓÔÁÎÄÁÒÔÎÙÍ ÐÁÒÁÍÅÔÒÏÍ <option>singlelabel</option>
	×ÏÚÍÏÖÎÁ ÔÏÌØËÏ ÏÄÎÁ ÍÅÔËÁ ÎÁ ×ÅÓØ ÒÁÚÄÅÌ.
	ðÁÒÁÍÅÔÒÙ <option>multilabel</option> É <option>singlelabel</option>
	ÔÒÅÂÕÀÔÓÑ ÔÏÌØËÏ ÄÌÑ ÐÏÌÉÔÉË, ÒÅÁÌÉÚÕÀÝÉÈ ÍÅÔËÉ, ×ËÌÀÞÁÑ
	Biba, Lomac, <acronym>MLS</acronym> É
	<acronym>SEBSD</acronym>.</para>

      <para>÷Ï ÍÎÏÇÉÈ ÓÌÕÞÁÑÈ <option>multilabel</option> ÍÏÖÅÔ ×ÏÏÂÝÅ ÎÅ
	ÐÏÔÒÅÂÏ×ÁÔØÓÑ.  ðÒÅÄÐÏÌÏÖÉÍ ÓÌÅÄÕÀÝÕÀ ÓÉÔÕÁÃÉÀ É ÍÏÄÅÌØ
	ÂÅÚÏÐÁÓÎÏÓÔÉ:</para>

      <itemizedlist>
	<listitem>
	  <para>&os; ×ÅÂ-ÓÅÒ×ÅÒ, ÉÓÐÏÌØÚÕÀÝÉÊ ÉÎÆÒÁÓÔÒÕËÔÕÒÕ
	    <acronym>MAC</acronym> É ÎÁÂÏÒ ÒÁÚÌÉÞÎÙÈ ÐÏÌÉÔÉË.</para>
	</listitem>

	<listitem>
	  <para>üÔÏÍÕ ËÏÍÐØÀÔÅÒÕ ÐÏÔÒÅÂÕÅÔÓÑ ÌÉÛØ ÏÄÎÁ ÍÅÔËÁ,
	    <literal>biba/high</literal>, ÄÌÑ ×ÓÅÊ ÓÉÓÔÅÍÙ.
	    æÁÊÌÏ×ÏÊ ÓÉÓÔÅÍÅ ÎÅ ÎÕÖÅÎ ÐÁÒÁÍÅÔÒ <option>multilabel</option>,
	    ÐÏÓËÏÌØËÕ ÐÏ ÕÍÏÌÞÁÎÉÀ ÒÁÂÏÔÁÅÔ ÏÄÉÎÏÞÎÁÑ ÍÅÔËÁ.</para>
	</listitem>

	<listitem>
	  <para>îÏ ÐÏÓËÏÌØËÕ ÜÔÏÔ ËÏÍÐØÀÔÅÒ ÂÕÄÅÔ ×Å ÓÅÒ×ÅÒÏÍ, ÐÒÏÃÅÓÓ
	    ×Å ÓÅÒ×ÅÒÁ ÄÏÌÖÅÎ ÂÙÔØ ÚÁÐÕÝÅÎ Ó <literal>biba/low</literal>
	    ÄÌÑ ÐÒÅÄÏÔ×ÒÁÝÅÎÉÑ ÚÁÐÉÓÉ.  ðÏÌÉÔÉËÁ Biba É ÔÏ, ËÁË ÏÎÁ
	    ÒÁÂÏÔÁÅÔ, ÂÕÄÅÔ ÏÂÓÕÖÄÁÔØÓÑ ÐÏÚÖÅ, ÐÏÜÔÏÍÕ ÐÒÅÄÙÄÕÝÉÊ ËÏÍÍÅÎÔÁÒÉÊ
	    ÓÌÏÖÎÏ ÉÎÔÅÒÐÒÅÔÉÒÏ×ÁÔØ; ÐÒÏÓÔÏ ÐÒÏÄÏÌÖÁÊÔÅ ÞÔÅÎÉÅ.
	    óÅÒ×ÅÒ ÍÏÖÅÔ ÉÓÐÏÌØÚÏ×ÁÔØ ÄÉÓËÏ×ÙÊ ÒÁÚÄÅÌ Ó ÕÓÔÁÎÏ×ÌÅÎÎÏÊ
	    ÍÅÔËÏÊ <literal>biba/low</literal> ÄÌÑ ÂÏÌØÛÉÎÓÔ×Á, ÅÓÌÉ
	    ÎÅ ÄÌÑ ×ÓÅÈ Ó×ÏÉÈ ÏÐÅÒÁÃÉÊ.  ÷ ÜÔÏÍ ÐÒÉÍÅÒÅ ÏÔÓÕÔÓÔ×ÕÀÔ ÍÎÏÇÉÅ
	    ÄÅÔÁÌÉ, ÔÁËÉÅ ËÁË ÏÇÒÁÎÉÞÅÎÉÑ ÎÁ ÄÁÎÎÙÅ, ËÏÎÆÉÇÕÒÁÃÉÑ ÓÉÓÔÅÍÙ
	    É ÕÓÔÁÎÏ×ËÉ ÐÏÌØÚÏ×ÁÔÅÌÅÊ; ÏÄÎÁËÏ, ÜÔÏ ÌÉÛØ ÐÒÅÄ×ÁÒÉÔÅÌØÎÙÊ
	    ÐÒÉÍÅÒ.</para>
	</listitem>
      </itemizedlist>

      <para>åÓÌÉ ÉÓÐÏÌØÚÕÅÔÓÑ ÌÀÂÁÑ ÉÚ ÐÏÌÉÔÉË, ÎÅ ÐÏÄÄÅÒÖÉ×ÁÀÝÉÈ ÍÅÔËÉ,
	ÐÁÒÁÍÅÔÒ <option>multilabel</option> ÎÅ ÔÒÅÂÕÅÔÓÑ.  óÀÄÁ ×ËÌÀÞÁÀÔÓÑ
	ÐÏÌÉÔÉËÉ <literal>seeotheruids</literal>, <literal>portacl</literal>
	É <literal>partition</literal>.</para>

      <para>îÅÏÂÈÏÄÉÍÏ ÔÁËÖÅ ÏÔÍÅÔÉÔØ, ÞÔÏ ÉÓÐÏÌØÚÏ×ÁÎÉÅ ÐÁÒÁÍÅÔÒÁ
	<option>multilabel</option> ÎÁ ÒÁÚÄÅÌÅ É ÕÓÔÁÎÏ×ÌÅÎÉÅ ÍÏÄÅÌÉ
	ÂÅÚÏÐÁÓÎÏÓÔÉ, ÏÓÎÏ×ÁÎÎÏÊ ÎÁ ÆÕÎËÃÉÏÎÁÌØÎÏÓÔÉ
	<option>multilabel</option>, ÍÏÖÅÔ ÐÏ×ÌÅÞØ ÚÁ ÓÏÂÏÊ
	ÍÎÏÖÅÓÔ×Ï ÄÏÐÏÌÎÉÔÅÌØÎÏÊ ÁÄÍÉÎÉÓÔÒÁÔÉ×ÎÏÊ ÒÁÂÏÔÙ, ÐÏÓËÏÌØËÕ ×ÓÅÍÕ ×
	ÆÁÊÌÏ×ÏÊ ÓÉÓÔÅÍÅ ÄÏÌÖÎÙ ÂÙÔØ ÐÒÉÓ×ÏÅÎÙ ÍÅÔËÉ.  üÔÏ ×ËÌÀÞÁÅÔ ËÁÔÁÌÏÇÉ,
	ÆÁÊÌÙ, É ÄÁÖÅ ÆÁÊÌÙ ÕÓÔÒÏÊÓÔ×.</para>

      <para>óÌÅÄÕÀÝÁÑ ËÏÍÁÎÄÁ ÕÓÔÁÎÏ×ÉÔ ÐÁÒÁÍÅÔÒ <option>multilabel</option>
	ÎÁ ÆÁÊÌÏ×ÙÈ ÓÉÓÔÅÍÁÈ.  üÔÏ ÍÏÖÅÔ ÂÙÔØ ÓÄÅÌÁÎÏ ÔÏÌØËÏ ×
	ÏÄÎÏÐÏÌØÚÏ×ÁÔÅÌØÓËÏÍ ÒÅÖÉÍÅ:</para>

      <screen>&prompt.root; <userinput>tunefs -l enable /</userinput></screen>

      <para>üÔÏ ÎÅ ÔÒÅÂÕÅÔÓÑ ÄÌÑ ÆÁÊÌÏ×ÏÊ ÓÉÓÔÅÍÙ ÐÏÄËÁÞËÉ.</para>

      <note>
	<para>îÅËÏÔÏÒÙÅ ÐÏÌØÚÏ×ÁÔÅÌÉ ÓÔÁÌËÉ×ÁÀÔÓÑ Ó ÐÒÏÂÌÅÍÁÍÉ ÐÒÉ
	  ÕÓÔÁÎÏ×ËÅ ÆÌÁÇÁ <option>multilabel</option> ÎÁ ËÏÒÎÅ×ÏÊ ÒÁÚÄÅÌ.
	  ÷ ÄÁÎÎÏÍ ÓÌÕÞÁÅ ÏÂÒÁÔÉÔÅÓØ Ë
	  <xref linkend="mac-troubleshoot">.</para>
      </note>
    </sect2>

    <sect2>
      <title>îÁÓÔÒÏÊËÁ MAC ÐÅÒÅÍÅÎÎÙÍÉ sysctl</title>

      <para>îÅÚÁ×ÉÓÉÍÏ ÏÔ ÚÁÇÒÕÚËÉ ÍÏÄÕÌÅÊ, ÓÕÝÅÓÔ×ÕÅÔ ÎÅÓËÏÌØËÏ ÞÁÓÔÅÊ
	<acronym>MAC</acronym>, ËÏÔÏÒÙÅ ÍÏÇÕÔ ÂÙÔØ ÎÁÓÔÒÏÅÎÙ Ó
	ÉÓÐÏÌØÚÏ×ÁÎÉÅÍ ÉÎÔÅÒÆÅÊÓÁ <command>sysctl</command>.  üÔÉ
	ÐÅÒÅÍÅÎÎÙÅ ÏÐÉÓÁÎÙ ÎÉÖÅ É ×Ï ×ÓÅÈ ÓÌÕÞÁÑÈ ÚÎÁÞÅÎÉÅ 1
	ÏÚÎÁÞÁÅÔ ×ËÌÀÞÅÎÉÅ, Á 0 &mdash; ÏÔËÌÀÞÅÎÉÅ:</para>

      <itemizedlist>
	<listitem>
	  <para><literal>security.mac.enforce_fs</literal> ÐÏ ÕÍÏÌÞÁÎÉÀ
	    ÕÓÔÁÎÏ×ÌÅÎÁ × 1 É ×ËÌÀÞÁÅÔ ÐÏÌÉÔÉËÉ
	    <acronym>MAC</acronym> ÎÁ ÆÁÊÌÏ×ÙÈ ÓÉÓÔÅÍÁÈ.</para>
	</listitem>

	<listitem>
	  <para><literal>security.mac.enforce_kld</literal> ÐÏ ÕÍÏÌÞÁÎÉÀ
	    1 É ×ËÌÀÞÁÅÔ ÌÉÎËÏ×ÁÎÉÅ ÐÏÌÉÔÉË <acronym>MAC</acronym> ×
	    ÑÄÒÅ (ÓÍ. &man.kld.4;).</para>
	</listitem>

	<listitem>
	  <para><literal>security.mac.enforce_network</literal> ÐÏ ÕÍÏÌÞÁÎÉÀ
	    1 É ×ËÌÀÞÁÅÔ ÓÅÔÅ×ÙÅ ÐÏÌÉÔÉËÉ <acronym>MAC</acronym>.</para>
	</listitem>

	<listitem>
	  <para><literal>security.mac.enforce_pipe</literal> ÐÏ ÕÍÏÌÞÁÎÉÀ
	    1 É ×ËÌÀÞÁÅÔ ÐÏÌÉÔÉËÉ <acronym>MAC</acronym> ÄÌÑ ËÁÎÁÌÏ×
	    (pipe).</para>
	</listitem>

	<listitem>
	  <para><literal>security.mac.enforce_process</literal> ÐÏ ÕÍÏÌÞÁÎÉÀ
	    1 É ×ËÌÀÞÁÅÔ ÐÏÌÉÔÉËÉ <acronym>MAC</acronym> ÄÌÑ ÐÒÏÃÅÓÓÏ×,
	    ÉÓÐÏÌØÚÕÀÝÉÈ ÓÒÅÄÓÔ×Á ÍÅÖÐÒÏÃÅÓÓÎÏÇÏ ×ÚÁÉÍÏÄÅÊÓÔ×ÉÑ.</para>
	</listitem>

	<listitem>
	  <para><literal>security.mac.enforce_socket</literal> ÐÏ ÕÍÏÌÞÁÎÉÀ
	    1 É ×ËÌÀÞÁÅÔ ÐÏÌÉÔÉËÉ <acronym>MAC</acronym> ÎÁ ÓÏËÅÔÁÈ
	    (ÓÍ. ÓÔÒÁÎÉÃÕ ÓÐÒÁ×ÏÞÎÉËÁ &man.socket.2;).</para>
	</listitem>

	<listitem>
	  <para><literal>security.mac.enforce_system</literal> ÐÏ ÕÍÏÌÞÁÎÉÀ
            1 É ×ËÌÀÞÁÅÔ ÐÏÌÉÔÉËÉ <acronym>MAC</acronym> ÄÌÑ ÄÅÊÓÔ×ÉÊ ÓÉÓÔÅÍÙ,
	    ÔÁËÉÈ ËÁË ÕÞÅÔ (accounting) É ÐÅÒÅÚÁÇÒÕÚËÁ.</para>
	</listitem>

	<listitem>
	  <para><literal>security.mac.enforce_vm</literal> ÐÏ ÕÍÏÌÞÁÎÉÀ
            1 É ×ËÌÀÞÁÅÔ ÐÏÌÉÔÉËÉ <acronym>MAC</acronym> ÄÌÑ ÓÉÓÔÅÍÙ
	    ×ÉÒÔÕÁÌØÎÏÊ ÐÁÍÑÔÉ.</para>
	</listitem>
      </itemizedlist>

      <note>
	<para>ëÁÖÄÁÑ ÐÏÌÉÔÉËÁ <acronym>MAC</acronym> ÐÏÄÄÅÒÖÉ×ÁÅÔ
	  ÐÅÒÅÍÅÎÎÙÅ <command>sysctl</command>.  ïÎÉ ÏÂÙÞÎÏ ÐÏÐÁÄÁÀÔ × ÄÅÒÅ×Ï
	  <literal>security.mac.&lt;policyname&gt;</literal>.
	  äÌÑ ÐÒÏÓÍÏÔÒÁ ×ÓÅÈ ÐÅÒÅÍÅÎÎÙÈ <acronym>MAC</acronym>,
	  ÉÓÐÏÌØÚÕÊÔÅ ÓÌÅÄÕÀÝÕÀ ËÏÍÁÎÄÕ:</para>

	<screen>&prompt.root; <userinput>sysctl -da | grep mac</userinput></screen>
      </note>

      <para>üÔÏ ÄÏÌÖÎÏ ÂÙÔØ ÉÎÔÅÒÐÒÅÔÉÒÏ×ÁÎÏ ÔÁË, ÞÔÏ ×ÓÅ ÏÓÎÏ×ÎÙÅ
	ÐÏÌÉÔÉËÉ <acronym>MAC</acronym> ×ËÌÀÞÅÎÙ ÐÏ ÕÍÏÌÞÁÎÉÀ.
	åÓÌÉ ÍÏÄÕÌÉ ×ÓÔÒÏÅÎÙ × ÑÄÒÏ, ÓÉÓÔÅÍÁ ÂÕÄÅÔ ÚÁÂÌÏËÉÒÏ×ÁÎÁ, É ÓËÏÒÅÅ
	×ÓÅÇÏ ÎÅ ÓÍÏÖÅÔ Ó×ÑÚÁÔØÓÑ Ó ÌÏËÁÌØÎÏÊ ÓÅÔØÀ ÉÌÉ Ó ÉÎÔÅÒÎÅÔ, É Ô.Ä.
	ðÏÜÔÏÍÕ ×ÓÔÒÁÉ×ÁÎÉÅ ÍÏÄÕÌÅÊ × ÑÄÒÏ ÎÅ ÒÅËÏÍÅÎÄÕÅÔÓÑ.  îÅ ÐÏÔÏÍÕ,
	ÞÔÏ ÜÔÏ ÏÇÒÁÎÉÞÉÔ ×ÏÚÍÏÖÎÏÓÔØ ÏÔËÌÀÞÅÎÉÑ ËÏÍÁÎÄÏÊ
	<command>sysctl</command>, Á ÐÏÔÏÍÕ, ÞÔÏ ×ËÌÀÞÅÎÉÅ ÐÏÌÉÔÉË ×
	×ÉÄÅ ÍÏÄÕÌÅÊ ÐÏÚ×ÏÌÉÔ ÁÄÍÉÎÉÓÔÒÁÔÏÒÕ ÐÅÒÅËÌÀÞÁÔØ ÐÏÌÉÔÉËÉ ÓÉÓÔÅÍÙ
	ÂÅÚ ÎÅÏÂÈÏÄÉÍÏÓÔÉ ÐÅÒÅÓÂÏÒËÉ É ÐÅÒÅÕÓÔÁÎÏ×ËÉ ÎÏ×ÏÊ ÓÉÓÔÅÍÙ.</para>
    </sect2>
  </sect1>

  <sect1 id="mac-modules">
    <title>îÁÓÔÒÏÊËÁ ÍÏÄÕÌÅÊ</title>

    <para>ëÁÖÄÙÊ ÍÏÄÕÌØ, ×ËÌÀÞÅÎÎÙÊ × ÉÎÆÒÁÓÔÒÕËÔÕÒÕ <acronym>MAC</acronym>,
      ÍÏÖÅÔ ÂÙÔØ ÉÌÉ ×ÓÔÒÏÅÎ × ÑÄÒÏ, ËÁË ÕÐÏÍÉÎÁÌÏÓØ ×ÙÛÅ, ÉÌÉ ÚÁÇÒÕÖÅÎ
      × ×ÉÄÅ ÍÏÄÕÌÑ ÑÄÒÁ.  òÅËÏÍÅÎÄÕÅÔÓÑ ÄÏÂÁ×ÌÅÎÉÅ ÉÍÅÎÉ ÍÏÄÕÌÑ ×
      ÆÁÊÌ <filename>/boot/loader.conf</filename>, ÜÔÏÔ ÍÏÄÕÌØ ÂÕÄÅÔ
      ÁËÔÉ×ÉÒÏ×ÁÎ × ÓÁÍÏÍ ÎÁÞÁÌÅ ÚÁÇÒÕÚËÉ.</para>

    <para>÷ ÐÏÓÌÅÄÕÀÝÉÈ ÒÁÚÄÅÌÁÈ ÂÕÄÕÔ ÏÂÓÕÖÄÁÔØÓÑ ÒÁÚÌÉÞÎÙÅ ÍÏÄÕÌÉ
      <acronym>MAC</acronym> É ÉÈ ×ÏÚÍÏÖÎÏÓÔÉ.  òÅÁÌÉÚÁÃÉÑ ÜÔÉÈ
      ×ÏÚÍÏÖÎÏÓÔÅÊ × ÏÐÒÅÄÅÌÅÎÎÙÈ ÓÉÔÕÁÃÉÑÈ ÔÁËÖÅ ÂÕÄÅÔ ÏÂÓÕÖÄÁÔØÓÑ
      × ÜÔÏÊ ÇÌÁ×Å.  îÅËÏÔÏÒÙÅ ÍÏÄÕÌÉ ÐÏÄÄÅÒÖÉ×ÁÀÔ ÉÓÐÏÌØÚÏ×ÁÎÉÅ
      ÍÅÔÏË, ËÏÔÏÒÙÅ ËÏÎÔÒÏÌÉÒÕÀÔ ÄÏÓÔÕÐ ÐÕÔÅÍ ÐÒÉÍÅÎÅÎÉÑ ÐÒÁ×ÉÌ
      ×ÉÄÁ <quote>ÜÔÏ ÒÁÚÒÅÛÅÎÏ, Á ÜÔÏ ÎÅÔ</quote>.  îÁÓÔÒÏÊËÁ ÍÅÔÏË ÍÏÖÅÔ
      ËÏÎÔÒÏÌÉÒÏ×ÁÔØ ÄÏÓÔÕÐ Ë ÆÁÊÌÁÍ, ÓÅÔÅ×ÙÍ ËÏÍÍÕÎÉËÁÃÉÑÍ É Ô.Ä.
      ÷ ÐÒÅÄÙÄÕÝÅÍ ÒÁÚÄÅÌÅ ÂÙÌÏ ÐÏËÁÚÁÎÏ ËÁË ÆÌÁÇ <option>multilabel</option>
      ÍÏÖÅÔ ÂÙÔØ ÕÓÔÁÎÏ×ÌÅÎ ÎÁ ÆÁÊÌÏ×ÙÅ ÓÉÓÔÅÍÙ ÄÌÑ ×ËÌÀÞÅÎÉÑ ËÏÎÔÒÏÌÑ
      ÄÏÓÔÕÐÁ ÐÏ ÆÁÊÌÁÍ ÉÌÉ ÐÏ ÒÁÚÄÅÌÁÍ.</para>

    <para>ëÏÎÆÉÇÕÒÁÃÉÑ Ó ÏÄÎÏÊ ÍÅÔËÏÊ ÎÅ ÄÏÐÕÓËÁÅÔ ÐÒÉÍÅÎÅÎÉÅ ÎÅÓËÏÌØËÉÈ
      ÍÅÔÏË × ÓÉÓÔÅÍÅ, ÐÏÜÔÏÍÕ ÐÁÒÁÍÅÔÒ <command>tunefs</command>
      ÎÁÚÙ×ÁÅÔÓÑ <option>multilabel</option>.</para>

    <sect2 id="mac-seeotheruids">
      <title>íÏÄÕÌØ MAC seeotheruids</title>

      <indexterm>
	<primary>MAC See Other UIDs Policy</primary>
      </indexterm>
      <para>éÍÑ ÍÏÄÕÌÑ: <filename>mac_seeotheruids.ko</filename></para>

      <para>óÔÒÏËÁ × ËÏÎÆÉÇÕÒÁÃÉÉ ÑÄÒÁ:
	<literal>options MAC_SEEOTHERUIDS</literal></para>

      <para>ðÁÒÁÍÅÔÒ ÚÁÇÒÕÚËÉ:
	<literal>mac_seeotheruids_load="YES"</literal></para>

      <para>íÏÄÕÌØ &man.mac.seeotheruids.4; ËÏÐÉÒÕÅÔ É ÒÁÓÛÉÒÑÅÔ
	ÐÅÒÅÍÅÎÎÙÅ <command>sysctl</command>
	<literal>security.bsd.see_other_uids</literal> É
	<literal>security.bsd.see_other_gids</literal>.  ïÎ
	ÎÅ ÔÒÅÂÕÅÔ ÕÓÔÁÎÏ×ËÉ ÍÅÔÏË É ÍÏÖÅÔ ÐÒÏÚÒÁÞÎÏ ÒÁÂÏÔÁÔØ Ó
	ÄÒÕÇÉÍÉ ÍÏÄÕÌÑÍÉ.</para>

      <para>ðÏÓÌÅ ÚÁÇÒÕÚËÉ ÍÏÄÕÌÑ, ÄÌÑ ÕÐÒÁ×ÌÅÎÉÑ ÉÍ ÍÏÇÕÔ ÂÙÔØ
	ÉÓÐÏÌØÚÏ×ÁÎÙ ÓÌÅÄÕÀÝÉÅ ÐÅÒÅÍÅÎÎÙÅ <command>sysctl</command>:</para>

      <itemizedlist>
	<listitem>
	  <para><literal>security.mac.seeotheruids.enabled</literal>
	    ×ËÌÀÞÉÔ ÍÏÄÕÌØ Ó ÎÁÓÔÒÏÊËÁÍÉ ÐÏ ÕÍÏÌÞÁÎÉÀ.  üÔÉ ÎÁÓÔÒÏÊËÉ
	    ÚÁÐÒÅÝÁÀÔ ÐÏÌØÚÏ×ÁÔÅÌÑÍ ÐÒÏÓÍÏÔÒ ÐÒÏÃÅÓÓÏ× É ÓÏËÅÔÏ×,
	    ÐÒÉÎÁÄÌÅÖÁÝÉÈ ÄÒÕÇÉÍ ÐÏÌØÚÏ×ÁÔÅÌÑÍ.</para>
	</listitem>

	<listitem>
	  <para>
	    <literal>security.mac.seeotheruids.specificgid_enabled</literal>
	    ÐÏÚ×ÏÌÉÔ ÉÓËÌÀÞÉÔØ ÏÐÒÅÄÅÌÅÎÎÙÅ ÇÒÕÐÐÙ ÉÚ ÜÔÏÊ ÐÏÌÉÔÉËÉ.
	    äÌÑ ÉÓËÌÀÞÅÎÉÑ ÏÐÒÅÄÅÌÅÎÎÏÊ ÇÒÕÐÐÙ, ÉÓÐÏÌØÚÕÊÔÅ ÐÅÒÅÍÅÎÎÕÀ
	    <command>sysctl</command>
	    <literal>security.mac.seeotheruids.specificgid=<replaceable>XXX</replaceable></literal>.
	    ÷ ÐÒÉÍÅÒÅ ×ÙÛÅ ÎÅÏÂÈÏÄÉÍÏ ÚÁÍÅÎÉÔØ <replaceable>XXX</replaceable>
	    ÎÁ ÞÉÓÌÏ×ÏÊ ID ÇÒÕÐÐÙ.</para>
	</listitem>

	<listitem>
	  <para>
	    <literal>security.mac.seeotheruids.primarygroup_enabled</literal>
	    ÉÓÐÏÌØÚÕÅÔÓÑ ÄÌÑ ÉÓËÌÀÞÅÎÉÑ ÏÐÒÅÄÅÌÅÎÎÏÊ ÏÓÎÏ×ÎÏÊ ÇÒÕÐÐÙ
	    ÉÚ ÜÔÏÊ ÐÏÌÉÔÉËÉ.  ðÒÉ ÉÓÐÏÌØÚÏ×ÁÎÉÉ ÜÔÏÊ ÐÅÒÅÍÅÎÎÏÊ
	    <literal>security.mac.seeotheruids.specificgid_enabled</literal>
	    ÍÏÖÅÔ ÂÙÔØ ÎÅ ÕÓÔÁÎÏ×ÌÅÎÁ.</para>
	</listitem>
      </itemizedlist>

      <para>îÅÏÂÈÏÄÉÍÏ ÏÔÍÅÔÉÔØ, ÞÔÏ ÐÏÌØÚÏ×ÁÔÅÌØ <username>root</username>
	ÎÅ Ñ×ÌÑÅÔÓÑ ÉÓËÌÀÞÅÎÉÅÍ ÉÚ ÜÔÏÊ ÐÏÌÉÔÉËÉ.  üÔÏ ÏÄÎÏ ÉÚ ÓÁÍÙÈ
	ÓÕÝÅÓÔ×ÅÎÎÙÈ ÒÁÚÌÉÞÉÊ ÍÅÖÄÕ <acronym>MAC</acronym> ×ÅÒÓÉÅÊ
	É ÏÂÙÞÎÙÍÉ ÐÅÒÅÍÅÎÎÙÍÉ, ÓÕÝÅÓÔ×ÕÀÝÉÍÉ ÐÏ ÕÍÏÌÞÁÎÉÀ:
	<literal>security.bsd.seeotheruids</literal>.</para>
    </sect2>
  </sect1>

  <sect1 id="mac-bsdextended">
    <title>íÏÄÕÌØ MAC bsdextended</title>

    <indexterm>
    <primary>MAC</primary>
      <secondary>File System Firewall Policy</secondary>
    </indexterm>
    <para>éÍÑ ÍÏÄÕÌÑ: <filename>mac_bsdextended.ko</filename></para>

    <para>óÔÒÏËÁ ËÏÎÆÉÇÕÒÁÃÉÉ ÑÄÒÁ:
      <literal>options MAC_BSDEXTENDED</literal></para>

    <para>ðÁÒÁÍÅÔÒ ÚÁÇÒÕÚËÉ:
      <literal>mac_bsdextended_load="YES"</literal></para>

    <para>íÏÄÕÌØ &man.mac.bsdextended.4; ×ËÌÀÞÁÅÔ ÂÒÁÎÄÍÁÕÜÒ ÆÁÊÌÏ×ÏÊ
      ÓÉÓÔÅÍÙ.  ðÏÌÉÔÉËÁ ÜÔÏÇÏ ÍÏÄÕÌÑ Ñ×ÌÑÅÔÓÑ ÒÁÓÛÉÒÅÎÉÅÍ ÓÔÁÎÄÁÒÔÎÏÊ
      ÍÏÄÅÌÉ ÒÁÚÒÅÛÅÎÉÊ ÆÁÊÌÏ×ÏÊ ÓÉÓÔÅÍÙ, ÐÏÚ×ÏÌÑÑ ÁÄÍÉÎÉÓÔÒÁÔÏÒÕ
      ÓÏÚÄÁ×ÁÔØ ÎÁÂÏÒ ÐÒÁ×ÉÌ ÄÌÑ ÚÁÝÉÔÙ ÆÁÊÌÏ×, ÕÔÉÌÉÔ É ËÁÔÁÌÏÇÏ×
      ÉÅÒÁÒÈÉÉ ÆÁÊÌÏ×ÏÊ ÓÉÓÔÅÍÙ × ÓÔÉÌÅ ÂÒÁÎÄÍÁÕÜÒÁ.</para>

    <para>ðÏÌÉÔÉËÁ ÍÏÖÅÔ ÂÙÔØ ÓÏÚÄÁÎÁ Ó ÐÏÍÏÝØÀ ÕÔÉÌÉÔÙ, &man.ugidfw.8;,
      ÓÉÎÔÁËÓÉÓ ËÏÔÏÒÏÊ ÐÏÈÏÖ ÎÁ ÓÉÎÔÁËÓÉÓ &man.ipfw.8;.  äÒÕÇÉÅ
      ÉÎÓÔÒÕÍÅÎÔÙ ÍÏÇÕÔ ÂÙÔØ ÎÁÐÉÓÁÎÙ Ó ÉÓÐÏÌØÚÏ×ÁÎÉÅÍ ÆÕÎËÃÉÊ ÂÉÂÌÉÏÔÅËÉ
      &man.libugidfw.3;.</para>

    <para>ðÒÉ ÒÁÂÏÔÅ Ó ÜÔÉÍ ÍÏÄÕÌÅÍ ÎÅÏÂÈÏÄÉÍÏ ÓÏÂÌÀÄÁÔØ ÏÓÏÂÕÀ
      ÏÓÔÏÒÏÖÎÏÓÔØ; ÎÅËÏÒÒÅËÔÎÏÅ ÅÇÏ ÉÓÐÏÌØÚÏ×ÁÎÉÅ ÍÏÖÅÔ ÚÁÂÌÏËÉÒÏ×ÁÔØ
      ÄÏÓÔÕÐ Ë ÏÔÄÅÌØÎÙÍ ÞÁÓÔÑÍ ÆÁÊÌÏ×ÏÊ ÓÉÓÔÅÍÙ.</para>

    <sect2>
      <title>ðÒÉÍÅÒÙ</title>

      <para>ðÏÓÌÅ ÚÁÇÒÕÚËÉ ÍÏÄÕÌÑ &man.mac.bsdextended.4; ÄÌÑ ÐÒÏÓÍÏÔÒÁ
	ÔÅËÕÝÅÊ ÎÁÓÔÒÏÊËÉ ÐÒÁ×ÉÌ ÍÏÖÅÔ ÂÙÔØ ÉÓÐÏÌØÚÏ×ÁÎÁ ÓÌÅÄÕÀÝÁÑ
	ËÏÍÁÎÄÁ:</para>

      <screen>&prompt.root; <userinput>ugidfw list</userinput>
0 slots, 0 rules</screen>

      <para>ëÁË É ÍÏÖÎÏ ÂÙÌÏ ÏÖÉÄÁÔØ, ÐÒÁ×ÉÌÁ ÎÅ ÏÐÒÅÄÅÌÅÎÙ.  üÔÏ
	ÏÚÎÁÞÁÅÔ, ÞÔÏ ÄÏÓÔÕÐ ÐÏÌÎÏÓÔØÀ ÏÔËÒÙÔ.  äÌÑ ÓÏÚÄÁÎÉÑ ÐÒÁ×ÉÌÁ,
	ËÏÔÏÒÏÅ ÚÁÂÌÏËÉÒÕÅÔ ÄÏÓÔÕÐ ×ÓÅÈ ÐÏÌØÚÏ×ÁÔÅÌÅÊ, ÎÏ ÎÅ ÐÏ×ÌÉÑÅÔ
	ÎÁ <username>root</username>, ÐÒÏÓÔÏ ÚÁÐÕÓÔÉÔÅ ÓÌÅÄÕÀÝÕÀ
	ËÏÍÁÎÄÕ:</para>

      <screen>&prompt.root; <userinput>ugidfw add subject not uid root new object not uid root mode n</userinput></screen>

      <note>
	<para>÷ ÒÅÌÉÚÁÈ &os; ÄÏ 5.3, ÐÁÒÁÍÅÔÒ <parameter>add</parameter>
	  ÎÅ ÓÕÝÅÓÔ×ÕÅÔ.  ÷ÍÅÓÔÏ ÎÅÇÏ ÎÅÏÂÈÏÄÉÍÏ ÉÓÐÏÌØÚÏ×ÁÔØ
	  <parameter>set</parameter>.  ðÒÉÍÅÒ ÄÁÎ ÎÉÖÅ.</para></note>

      <para>üÔÏ ÏÞÅÎØ ÐÌÏÈÁÑ ÉÄÅÑ, ÐÏÓËÏÌØËÕ ÔÁËÏÅ ÐÒÁ×ÉÌÏ ÚÁÐÒÅÔÉÔ
	ÐÏÌØÚÏ×ÁÔÅÌÑÍ ÉÓÐÏÌØÚÏ×ÁÔØ ÄÁÖÅ ÓÁÍÙÅ ÐÒÏÓÔÙÅ ËÏÍÁÎÄÙ, ÔÁËÉÅ
	ËÁË <command>ls</command>.  âÏÌÅÅ ÐÁÔÒÉÏÔÉÞÅÓËÉÊ ÓÐÉÓÏË ÐÒÁ×ÉÌ
	ÍÏÖÅÔ ÂÙÔØ ÔÁËÉÍ:</para>

      <screen>&prompt.root; <userinput>ugidfw set 2 subject uid <replaceable>user1</replaceable> object uid <replaceable>user2</replaceable> mode n</userinput>
&prompt.root; <userinput>ugidfw set 3 subject uid <replaceable>user1</replaceable> object gid <replaceable>user2</replaceable> mode n</userinput></screen>

      <para>üÔÉ ËÏÍÁÎÄÙ ÚÁÐÒÅÔÑÔ ×ÅÓØ É ÌÀÂÏÊ ÄÏÓÔÕÐ ÐÏÌØÚÏ×ÁÔÅÌÑ
	<username>user1</username>, ×ËÌÀÞÁÑ ÐÒÏÓÍÏÔÒ ÐÏÄËÁÔÁÌÏÇÏ×, Ë
	ÄÏÍÁÛÎÅÍÕ ËÁÔÁÌÏÇÕ ÐÏÌØÚÏ×ÁÔÅÌÑ
	<username><replaceable>user2</replaceable></username>.</para>

      <para>÷ÍÅÓÔÏ <username>user1</username> ÍÏÖÅÔ ÂÙÔØ ÚÁÄÁÎÏ
	<option>not uid <replaceable>user2</replaceable></option>.
	üÔÏ ×ËÌÀÞÉÔ ÔÅ ÏÇÒÁÎÉÞÅÎÉÑ,
	Ï ËÏÔÏÒÙÈ ÇÏ×ÏÒÉÌÏÓØ ×ÙÛÅ, ÄÌÑ ×ÓÅÈ ÐÏÌØÚÏ×ÁÔÅÌÅÊ ËÒÏÍÅ
	ÏÄÎÏÇÏ.</para>

      <note>
	<para>îÁ ÐÏÌØÚÏ×ÁÔÅÌÑ <username>root</username> ÜÔÉ ÉÚÍÅÎÅÎÉÑ ÎÅ
	  ÐÏ×ÌÉÑÀÔ.</para>
      </note>

      <para>íÁÔÅÒÉÁÌ ×ÙÛÅ ÄÏÌÖÅÎ ÄÁÔØ ÏÂÝÕÀ ÉÄÅÀ ËÁË ÍÏÄÕÌØ
	&man.mac.bsdextended.4; ÍÏÖÅÔ ÂÙÔØ ÉÓÐÏÌØÚÏ×ÁÎ × ËÁÞÅÓÔ×Å ÓÒÅÄÓÔ×Á
	ÚÁÝÉÔÙ ÆÁÊÌÏ×ÏÊ ÓÉÓÔÅÍÙ.  úÁ ÄÁÌØÎÅÊÛÅÊ ÉÎÆÏÒÍÁÃÉÅÊ ÏÂÒÁÝÁÊÔÅÓØ
	Ë ÓÔÒÁÎÉÃÁÍ ÓÐÒÁ×ÏÞÎÉËÁ &man.mac.bsdextended.4; É
	&man.ugidfw.8;.</para>
    </sect2>
  </sect1>

  <sect1 id="mac-ifoff">
    <title>íÏÄÕÌØ MAC ifoff</title>

    <indexterm>
      <primary>MAC Interface Silencing Policy</primary>
    </indexterm>
    <para>éÍÑ ÍÏÄÕÌÑ: <filename>mac_ifoff.ko</filename></para>

    <para>óÔÒÏËÁ ËÏÎÆÉÇÕÒÁÃÉÉ ÑÄÒÁ:
      <literal>options MAC_IFOFF</literal></para>

    <para>ðÁÒÁÍÅÔÒ ÚÁÇÒÕÚËÉ: <literal>mac_ifoff_load="YES"</literal></para>

    <para>íÏÄÕÌØ &man.mac.ifoff.4; ÓÕÝÅÓÔ×ÕÅÔ ÔÏÌØËÏ ÄÌÑ ÏÔËÌÀÞÅÎÉÑ
      ÓÅÔÅ×ÙÈ ÉÎÔÅÒÆÅÊÓÏ× × ÒÁÂÏÔÁÀÝÅÊ ÓÉÓÔÅÍÅ É ÕÄÅÒÖÁÎÉÑ ÉÈ ÏÔ
      ÏÔÐÒÁ×ËÉ ÐÁËÅÔÏ× ×Ï ×ÒÅÍÑ ÎÁÞÁÌØÎÏÊ ÚÁÇÒÕÚËÉ.  üÔÏ ÎÅ ÔÒÅÂÕÅÔ
      ÕÓÔÁÎÏ×ÌÅÎÉÑ × ÓÉÓÔÅÍÅ ËÁËÉÈ-ÌÉÂÏ ÍÅÔÏË, ÎÅÔ É ÚÁ×ÉÓÉÍÏÓÔÉ ÏÔ
      ÄÒÕÇÉÈ ÍÏÄÕÌÅÊ <acronym>MAC</acronym>.</para>

    <para>âÏÌØÛÁÑ ÞÁÓÔØ ÕÐÒÁ×ÌÅÎÉÑ ÍÏÖÅÔ ÂÙÔØ ×ÙÐÏÌÎÅÎÁ ÞÅÒÅÚ
      ÐÅÒÅÍÅÎÎÙÅ <command>sysctl</command>.</para>

    <itemizedlist>
      <listitem>
	<para><literal>security.mac.ifoff.lo_enabled</literal>
	  ×ËÌÀÞÁÅÔ/×ÙËÌÀÞÁÅÔ ×ÅÓØ ÔÒÁÆÉË ÎÁ loopback (&man.lo.4;)
	  ÉÎÔÅÒÆÅÊÓÅ.</para>
      </listitem>

      <listitem>
	<para><literal>security.mac.ifoff.bpfrecv_enabled</literal>
	  ×ËÌÀÞÁÅÔ/×ÙËÌÀÞÁÅÔ ×ÅÓØ ÔÒÁÆÉË ÎÁ ÉÎÔÅÒÆÅÊÓÅ Berkeley Packet
	  Filter (&man.bpf.4;).</para>
      </listitem>

      <listitem>
	<para><literal>security.mac.ifoff.other_enabled</literal>
	  ×ËÌÀÞÁÅÔ/×ÙËÌÀÞÁÅÔ ×ÅÓØ ÔÒÁÆÉË ÎÁ ×ÓÅÈ ÄÒÕÇÉÈ ÉÎÔÅÒÆÅÊÓÁÈ.</para>
      </listitem>
    </itemizedlist>

    <para>ïÄÎÏ ÉÚ ÎÁÉÂÏÌÅÅ ÞÁÓÔÙÈ ÉÓÐÏÌØÚÏ×ÁÎÉÊ &man.mac.ifoff.4; ÜÔÏ
      ÓÅÔÅ×ÏÊ ÍÏÎÉÔÏÒÉÎÇ × ÓÒÅÄÅ, ÇÄÅ ÓÅÔÅ×ÏÊ ÔÒÁÆÉË ÎÅ ÄÏÌÖÅÎ ÂÙÔØ
      ÒÁÚÒÅÛÅÎ ×Ï ×ÒÅÍÑ ÚÁÇÒÕÚËÉ.  äÒÕÇÏÅ ÐÒÅÄÌÁÇÁÅÍÏÅ ÐÒÉÍÅÎÅÎÉÅ
      ÜÔÏ ÎÁÐÉÓÁÎÉÅ ÓËÒÉÐÔÁ, ÉÓÐÏÌØÚÕÀÝÅÇÏ
      <filename role="package">security/aide</filename> ÄÌÑ Á×ÔÏÍÁÔÉÞÅÓËÏÇÏ
      ÂÌÏËÉÒÏ×ÁÎÉÑ ÓÅÔÅ×ÏÇÏ ÔÒÁÆÉËÁ, ÅÓÌÉ ÂÕÄÕÔ ÏÂÎÁÒÕÖÅÎÙ ÎÏ×ÙÅ ÉÌÉ
      ÉÚÍÅÎÅÎÎÙÅ ÆÁÊÌÙ × ÚÁÝÉÝÁÅÍÙÈ ËÁÔÁÌÏÇÁÈ.</para>
  </sect1>

  <sect1 id="mac-portacl">
    <title>íÏÄÕÌØ MAC portacl</title>

    <indexterm>
      <primary>MAC Port Access Control List Policy</primary>
    </indexterm>
    <para>éÍÑ ÍÏÄÕÌÑ: <filename>mac_portacl.ko</filename></para>

    <para>óÔÒÏËÁ ËÏÎÆÉÇÕÒÁÃÉÉ ÑÄÒÁ:
      <literal>MAC_PORTACL</literal></para>

    <para>ðÁÒÁÍÅÔÒ ÚÁÇÒÕÚËÉ: <literal>mac_portacl_load="YES"</literal></para>

    <para>íÏÄÕÌØ &man.mac.portacl.4; ÉÓÐÏÌØÚÕÅÔÓÑ ÄÌÑ ÏÇÒÁÎÉÞÅÎÉÑ ÐÒÉ×ÑÚËÉ
      (binding) Ë ÌÏËÁÌØÎÙÍ ÐÏÒÔÁÍ <acronym>TCP</acronym> É
      <acronym>UDP</acronym>, ÉÓÐÏÌØÚÕÑ ÒÁÚÌÉÞÎÙÅ ÐÅÒÅÍÅÎÎÙÅ
      <command>sysctl</command>.  ðÏ ÓÕÔÉ &man.mac.portacl.4;
      ÄÅÌÁÅÔ ×ÏÚÍÏÖÎÏÊ ÐÒÉ×ÑÚËÕ Ë ÐÒÉ×ÉÌÅÇÉÒÏ×ÁÎÎÙÍ ÐÏÒÔÁÍ, Ô.Å. Ë ÐÏÒÔÁÍ
      Ó ÎÏÍÅÒÁÍÉ ÍÅÎØÛÅ 1024 ÄÌÑ ÎÅ-<username>root</username>
      ÐÏÌØÚÏ×ÁÔÅÌÅÊ.</para>

    <para>ðÏÓÌÅ ÚÁÇÒÕÚËÉ ÜÔÏÔ ÍÏÄÕÌØ ×ËÌÀÞÉÔ ÐÏÌÉÔÉËÕ <acronym>MAC</acronym>
      ÎÁ ×ÓÅÈ ÓÏËÅÔÁÈ.  äÏÓÔÕÐÎÙ ÓÌÅÄÕÀÝÉÅ ÐÅÒÅÍÅÎÎÙÅ
      <command>sysctl</command>:</para>

    <itemizedlist>
      <listitem>
	<para><literal>security.mac.portacl.enabled</literal>
	  ×ËÌÀÞÁÅÔ/ÏÔËÌÀÞÁÅÔ ÐÏÌÉÔÉËÕ ÃÅÌÉËÏÍ.
	  <footnote><para>÷ÓÌÅÄÓÔ×ÉÅ ÏÛÉÂËÉ
	  ÐÅÒÅÍÅÎÎÁÑ <command>sysctl</command>
	  <literal>security.mac.portacl.enabled</literal> ÎÅ ÂÕÄÅÔ ÒÁÂÏÔÁÔØ
	  ×  &os;&nbsp;5.2.1 ÉÌÉ ÂÏÌÅÅ ÒÁÎÎÉÈ ÒÅÌÉÚÁÈ.</para></footnote></para>
      </listitem>

      <listitem>
	<para><literal>security.mac.portacl.port_high</literal>
	  ÕÓÔÁÎÏ×ÉÔ ÎÁÉÂÏÌØÛÉÊ ÎÏÍÅÒ ÐÏÒÔÁ, ÄÌÑ ËÏÔÏÒÏÇÏ
	  &man.mac.portacl.4; ×ËÌÀÞÁÅÔ ÚÁÝÉÔÕ.</para>
      </listitem>

      <listitem>
	<para><literal>security.mac.portacl.suser_exempt</literal>,
	  ÅÓÌÉ ÕÓÔÁÎÏ×ÌÅÎÁ × ÎÅÎÕÌÅ×ÏÅ ÚÎÁÞÅÎÉÅ, ÉÓËÌÀÞÁÅÔ ÐÏÌØÚÏ×ÁÔÅÌÑ
	  <username>root</username> ÉÚ ÜÔÏÊ ÐÏÌÉÔÉËÉ.</para>
      </listitem>

      <listitem>
	<para><literal>security.mac.portacl.rules</literal>
	  ÚÁÄÁÅÔ ÄÅÊÓÔ×ÕÀÝÕÀ ÐÏÌÉÔÉËÕ mac_portacl: ÓÍ. ÎÉÖÅ.</para>
      </listitem>
    </itemizedlist>

    <para>äÅÊÓÔ×ÕÀÝÁÑ ÐÏÌÉÔÉËÁ <literal>mac_portacl</literal>,
      ÕËÁÚÁÎÎÁÑ × <literal>security.mac.portacl.rules</literal>,
      ÜÔÏ ÔÅËÓÔÏ×ÁÑ ÓÔÒÏËÁ × ÆÏÒÍÅ <literal>rule[,rule,...]</literal>
      Ó ÔÁËÉÍ ËÏÌÉÞÅÓÔ×ÏÍ ÐÒÁ×ÉÌ, ËÏÔÏÒÏÅ ÔÒÅÂÕÅÔÓÑ.  ëÁÖÄÏÅ ÐÒÁ×ÉÌÏ
      ÚÁÄÁÅÔÓÑ × ÆÏÒÍÁÔÅ:
      <literal>idtype:id:protocol:port</literal>.  ðÁÒÁÍÅÔÒ
      <parameter>idtype</parameter> ÍÏÖÅÔ ÐÒÉÎÉÍÁÔØ ÚÎÁÞÅÎÉÑ
      <literal>uid</literal> ÉÌÉ <literal>gid</literal> É ÉÓÐÏÌØÚÕÅÔÓÑ
      ÄÌÑ ÉÎÔÅÒÐÒÅÔÁÃÉÉ ÐÁÒÁÍÅÔÒÁ <parameter>id</parameter>,
      × ËÁÞÅÓÔ×Å id ÐÏÌØÚÏ×ÁÔÅÌÑ ÉÌÉ ÇÒÕÐÐÙ ÓÏÏÔ×ÅÔÓÔ×ÅÎÎÏ.
      ðÁÒÁÍÅÔÒ <parameter>protocol</parameter> ÉÓÐÏÌØÚÕÅÔÓÑ ÄÌÑ
      ÏÐÒÅÄÅÌÅÎÉÑ ÐÒÉÍÅÎÉÍÏÓÔÉ ÜÔÏÇÏ ÐÒÁ×ÉÌÁ Ë ÐÒÏÔÏËÏÌÕ
      <acronym>TCP</acronym> ÉÌÉ <acronym>UDP</acronym>, ÏÎ ÍÏÖÅÔ
      ÐÒÉÎÉÍÁÔØ ÚÎÁÞÅÎÉÑ <literal>tcp</literal> ÉÌÉ
      <literal>udp</literal>.  ðÏÓÌÅÄÎÉÊ ÐÁÒÁÍÅÔÒ,
      <parameter>port</parameter>, ÚÁÄÁÅÔ ÎÏÍÅÒ ÐÏÒÔÁ, Ë ËÏÔÏÒÏÍÕ
      ÒÁÚÒÅÛÁÅÔÓÑ ÐÒÉ×ÑÚËÁ ÕËÁÚÁÎÎÏÇÏ ÐÏÌØÚÏ×ÁÔÅÌÑ ÉÌÉ ÇÒÕÐÐÙ.</para>

    <note>
      <para>ðÏÓËÏÌØËÕ ÎÁÂÏÒ ÐÒÁ×ÉÌ ÉÎÔÅÒÐÒÅÔÉÒÕÅÔÓÑ ÎÅÐÏÓÒÅÄÓÔ×ÅÎÎÏ
	ÑÄÒÏÍ, ÄÌÑ ID ÐÏÌØÚÏ×ÁÔÅÌÑ, ÇÒÕÐÐÙ É ÎÏÍÅÒÁ ÐÏÒÔÁ ÍÏÇÕÔ ÂÙÔØ
	ÉÓÐÏÌØÚÏ×ÁÎÙ ÔÏÌØËÏ ÞÉÓÌÏ×ÙÅ ÚÎÁÞÅÎÉÑ.  ô.Å. ÉÍÅÎÁ ÐÏÌØÚÏ×ÁÔÅÌÅÊ,
	ÇÒÕÐÐ É ÓÅÒ×ÉÓÏ× ÐÏÒÔÏ× ÎÅ ÍÏÇÕÔ ÂÙÔØ ÉÓÐÏÌØÚÏ×ÁÎÙ.</para>
    </note>

    <para>ðÏ ÕÍÏÌÞÁÎÉÀ × &unix;-ÐÏÄÏÂÎÙÈ ÓÉÓÔÅÍÁÈ ÐÏÒÔÙ Ó ÎÏÍÅÒÁÍÉ
      ÍÅÎÅÅ ÞÅÍ 1024 ÍÏÇÕÔ ÂÙÔØ ÉÓÐÏÌØÚÏ×ÁÎÙ ÔÏÌØËÏ ÐÒÉ×ÉÌÅÇÉÒÏ×ÁÎÎÙÍÉ
      ÐÒÏÃÅÓÓÁÍÉ, Ô.Å. ÔÅÍÉ, ÞÔÏ ÚÁÐÕÝÅÎÙ ÏÔ <username>root</username>.
      ó &man.mac.portacl.4; ÄÌÑ ÒÁÚÒÅÛÅÎÉÑ ÐÒÉ×ÑÚËÉ ÎÅÐÒÉ×ÉÌÅÇÉÒÏ×ÁÎÎÙÈ
      ÐÒÏÃÅÓÓÏ× Ë ÐÏÒÔÁÍ Ó ÎÏÍÅÒÁÍÉ ÎÉÖÅ 1024 ÜÔÉ ÓÔÁÎÄÁÒÔÎÙÅ ÏÇÒÁÎÉÞÅÎÉÑ
      &unix; ÄÏÌÖÎÙ ÂÙÔØ ÏÔÍÅÎÅÎÙ.  üÔÏ ÍÏÖÅÔ ÂÙÔØ ×ÙÐÏÌÎÅÎÏ ÐÕÔÅÍ
      ÕÓÔÁÎÏ×ËÉ ÐÅÒÅÍÅÎÎÙÈ &man.sysctl.8;
      <literal>net.inet.ip.portrange.reservedlow</literal> É
      <literal>net.inet.ip.portrange.reservedhigh</literal>
      × ÎÏÌØ.</para>

    <para>ïÂÒÁÔÉÔÅÓØ Ë ÐÒÉÍÅÒÁÍ ÎÉÖÅ ÉÌÉ Ë ÓÔÒÁÎÉÃÅ ÓÐÒÁ×ÏÞÎÉËÁ
      &man.mac.portacl.4; ÚÁ ÄÁÌØÎÅÊÛÅÊ ÉÎÆÏÒÍÁÃÉÅÊ.</para>

    <sect2>
      <title>ðÒÉÍÅÒÙ</title>

      <para>óÌÅÄÕÀÝÉÅ ÐÒÉÍÅÒÙ ÄÏÌÖÎÙ ÏÓ×ÅÔÉÔØ ÏÂÓÕÖÄÅÎÉÅ ×ÙÛÅ ÞÕÔØ
	ÌÕÞÛÅ:</para>

      <screen>&prompt.root; <userinput>sysctl security.mac.portacl.port_high=1023</userinput>
&prompt.root; <userinput>sysctl net.inet.ip.portrange.reservedlow=0 net.inet.ip.portrange.reservedhigh=0</userinput></screen>

      <para>óÎÁÞÁÌÁ ÍÙ ÎÁÓÔÒÁÉ×ÁÅÍ &man.mac.portacl.4; ÄÌÑ ÒÁÂÏÔÙ ÓÏ
	ÓÔÁÎÄÁÒÔÎÙÍÉ ÐÒÉ×ÉÌÅÇÉÒÏ×ÁÎÎÙÍÉ ÐÏÒÔÁÍÉ É ÏÔÍÅÎÙ ÏÂÙÞÎÙÈ
	ÏÇÒÁÎÉÞÅÎÉÊ &unix; ÎÁ ÐÒÉ×ÑÚËÕ.</para>

      <screen>&prompt.root; <userinput>sysctl security.mac.portacl.suser_exempt=1</userinput></screen>

      <para>ðÏÌØÚÏ×ÁÔÅÌØ <username>root</username> ÄÏÌÖÅÎ ÂÙÔØ ÉÓËÌÀÞÅÎ
	ÉÚ ÜÔÏÊ ÐÏÌÉÔÉËÉ, ÄÌÑ ÜÔÏÇÏ ÐÅÒÅÍÅÎÎÁÑ
	<literal>security.mac.portacl.suser_exempt</literal>
	ÕÓÔÁÎÏ×ÌÅÎÁ × ÎÅÎÕÌÅ×ÏÅ ÚÎÁÞÅÎÉÅ.  íÏÄÕÌØ &man.mac.portacl.4;
	ÔÅÐÅÒØ ÎÁÓÔÒÏÅÎ ÎÁ ÔÏ ÐÏ×ÅÄÅÎÉÅ &unix;-ÐÏÄÏÂÎÙÈ ÓÉÓÔÅÍ ÐÏ
	ÕÍÏÌÞÁÎÉÀ.</para>

      <screen>&prompt.root; <userinput>sysctl security.mac.portacl.rules=uid:80:tcp:80</userinput></screen>

      <para>òÁÚÒÅÛÁÅÔ ÐÏÌØÚÏ×ÁÔÅÌÀ Ó <acronym>UID</acronym> 80 (ÏÂÙÞÎÏ
	ÜÔÏ ÐÏÌØÚÏ×ÁÔÅÌØ <username>www</username>) ÐÒÉ×ÑÚËÕ Ë ÐÏÒÔÕ 80.
	ôÅÐÅÒØ ÐÏÌØÚÏ×ÁÔÅÌØ <username>www</username> ÓÍÏÖÅÔ ÚÁÐÕÓÔÉÔØ
	×Å ÓÅÒ×ÅÒ ÄÁÖÅ ÂÅÚ ÐÒÉ×ÉÌÅÇÉÉ <username>root</username>.</para>

      <screen>&prompt.root; <userinput>sysctl security.mac.portacl.rules=uid:1001:tcp:110,uid:1001:tcp:995</userinput></screen>

      <para>òÁÚÒÅÛÉÔ ÐÏÌØÚÏ×ÁÔÅÌÀ Ó <acronym>UID</acronym>
	1001 ÐÒÉ×ÑÚËÕ Ë <acronym>TCP</acronym> ÐÏÒÔÁÍ 110
	(<quote>pop3</quote>) É 995 (<quote>pop3s</quote>).
	üÔÏ ÐÏÚ×ÏÌÉÔ ÄÁÎÎÏÍÕ ÐÏÌØÚÏ×ÁÔÅÌÀ ÚÁÐÕÓÔÉÔØ ÓÅÒ×ÅÒ, ÐÒÉÎÉÍÁÀÝÉÊ
	ÓÏÅÄÉÎÅÎÉÑ ÎÁ ÐÏÒÔÁÈ 110 É 995.</para>
    </sect2>
  </sect1>

  <sect1 id="mac-labelingpolicies">
    <title>ðÏÌÉÔÉËÉ MAC, ÉÓÐÏÌØÚÕÀÝÉÅ ÍÅÔËÉ</title>

    <para>÷ ÓÌÅÄÕÀÝÉÈ ÎÅÓËÏÌØËÉÈ ÒÁÚÄÅÌÁÈ ÂÕÄÕÔ ÏÂÓÕÖÄÁÔØÓÑ ÐÏÌÉÔÉËÉ
      <acronym>MAC</acronym>, ÉÓÐÏÌØÚÕÀÝÉÅ ÍÅÔËÉ.</para>

    <para>ó ÜÔÏÇÏ ÍÏÍÅÎÔÁ ÏÂÓÕÖÄÅÎÉÅ ÂÕÄÅÔ ÓÆÏËÕÓÉÒÏ×ÁÎÏ ÎÁ ×ÏÚÍÏÖÎÏÓÔÑÈ
      &man.mac.biba.4;, &man.mac.lomac.4;,
      &man.mac.partition.4;, É &man.mac.mls.4;.</para>

    <note>
      <para>üÔÏ ÌÉÛØ ÐÒÉÍÅÒÎÙÅ ÎÁÓÔÒÏÊËÉ, ÏÎÉ ÎÅ ÄÏÌÖÎÙ ÉÓÐÏÌØÚÏ×ÁÔØÓÑ
	ÎÅÐÏÓÒÅÄÓÔ×ÅÎÎÏ × ÒÅÁÌØÎÙÈ ÚÁÄÁÞÁÈ.  ãÅÌØ ÉÚÌÏÖÅÎÉÑ × ÔÏÍ, ÞÔÏÂÙ
	ÄÏËÕÍÅÎÔÉÒÏ×ÁÔØ É ÐÏËÁÚÁÔØ ÓÉÎÔÁËÓÉÓ, Á ÔÁËÖÅ ÐÒÉÍÅÒÙ
	ÒÅÁÌÉÚÁÃÉÉ É ÔÅÓÔÉÒÏ×ÁÎÉÑ.</para>
    </note>

    <para>äÌÑ ÐÒÁ×ÉÌØÎÏÊ ÒÁÂÏÔÙ ÜÔÉÈ ÐÏÌÉÔÉË ÎÅÏÂÈÏÄÉÍÏ ×ÙÐÏÌÎÉÔØ
      ÎÅËÏÔÏÒÙÅ ÐÒÉÇÏÔÏ×ÌÅÎÉÑ.</para>

    <sect2 id="mac-prep">
      <title>ðÒÉÇÏÔÏ×ÌÅÎÉÑ Ë ÉÓÐÏÌØÚÏ×ÁÎÉÀ ÐÏÌÉÔÉË Ó ÍÅÔËÁÍÉ</title>

      <para>÷ ÆÁÊÌ <filename>login.conf</filename> ÎÅÏÂÈÏÄÉÍÏ
	×ÎÅÓÔÉ ÓÌÅÄÕÀÝÉÅ ÉÚÍÅÎÅÎÉÑ:</para>

      <itemizedlist>
	<listitem>
	  <para>äÏÌÖÅÎ ÂÙÔØ ÄÏÂÁ×ÌÅÎ ËÌÁÓÓ <literal>insecure</literal>,
	    ÉÌÉ ÄÒÕÇÏÊ ÐÏÄÏÂÎÙÊ ËÌÁÓÓ.  îÁÌÉÞÉÅ ËÌÁÓÓÁ
	    <literal>insecure</literal> ÎÅ ÏÂÑÚÁÔÅÌØÎÏ, ÏÎ ÐÒÉ×ÏÄÉÔÓÑ
	    ÚÄÅÓØ × ËÁÞÅÓÔ×Å ÐÒÉÍÅÒÁ; ÄÒÕÇÉÅ ËÏÎÆÉÇÕÒÁÃÉÉ ÍÏÇÕÔ ÉÓÐÏÌØÚÏ×ÁÔØ
	    ÄÒÕÇÏÅ ÉÍÑ ËÌÁÓÓÁ.</para>
	</listitem>

	<listitem>
	  <para>ëÌÁÓÓ <literal>insecure</literal> ÄÏÌÖÅÎ ÉÓÐÏÌØÚÏ×ÁÔØ
	    ÐÒÉ×ÅÄÅÎÎÙÅ ÎÉÖÅ ÎÁÓÔÒÏÊËÉ É ÏÐÒÅÄÅÌÅÎÉÑ.  îÅËÏÔÏÒÙÅ ÉÚ ÎÉÈ
	    ÍÏÇÕÔ ÂÙÔØ ÉÚÍÅÎÅÎÙ, ÎÏ ÓÔÒÏËÁ, ÏÐÒÅÄÅÌÑÀÝÁÑ ÍÅÔËÕ ÐÏ
	    ÕÍÏÌÞÁÎÉÀ, ÎÅÏÂÈÏÄÉÍÁ É ÄÏÌÖÎÁ ÂÙÔØ ÏÓÔÁ×ÌÅÎÁ.</para>

	  <programlisting>insecure:\
	:copyright=/etc/COPYRIGHT:\
	:welcome=/etc/motd:\
	:setenv=MAIL=/var/mail/$,BLOCKSIZE=K:\
	:path=~/bin:/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin:\
	:manpath=/usr/share/man /usr/local/man:\
	:nologin=/usr/sbin/nologin:\
	:cputime=1h30m:\
	:datasize=8M:\
	:vmemoryuse=100M:\
	:stacksize=2M:\
	:memorylocked=4M:\
	:memoryuse=8M:\
	:filesize=8M:\
	:coredumpsize=8M:\
	:openfiles=24:\
	:maxproc=32:\
	:priority=0:\
	:requirehome:\
	:passwordtime=91d:\
	:umask=022:\
	:ignoretime@:\
	:label=partition/13,mls/5,biba/low:</programlisting>

	  <para>ðÅÒÅÄ ÔÅÍ, ËÁË ÐÅÒÅËÌÀÞÁÔØ ÐÏÌØÚÏ×ÁÔÅÌÅÊ ÎÁ ÎÏ×ÙÊ ËÌÁÓÓ,
	    ÎÅÏÂÈÏÄÉÍÏ ÚÁÐÕÓÔÉÔØ ËÏÍÁÎÄÕ &man.cap.mkdb.1; ÎÁ
	    &man.login.conf.5;.</para>

	  <para>ðÏÌØÚÏ×ÁÔÅÌÀ <username>root</username> ÔÁËÖÅ ÎÅÏÂÈÏÄÉÍÏ
	    ÐÒÉÓ×ÏÉÔØ ËÌÁÓÓ; ÉÎÁÞÅ, ÐÏÞÔÉ ÌÀÂÏÊ ËÏÍÁÎÄÅ, ×ÙÐÏÌÎÑÅÍÏÊ
	    ÏÔ <username>root</username>, ÐÏÔÒÅÂÕÅÔÓÑ ÉÓÐÏÌØÚÏ×ÁÎÉÅ
	    <command>setpmac</command>.</para> 
<!-- why?
	  <warning>
	    <para>Rebuilding the <filename>login.conf</filename>
	      database may cause some errors later with the daemon
	      class.  Simply uncommenting the daemon account and
	      rebuilding the database should alleviate these
	      issues.</para>
	  </warning>
-->
	</listitem>

	<listitem>
	  <para>õÂÅÄÉÔÅÓØ, ÞÔÏ ×ÓÅ ÒÁÚÄÅÌÙ, ÎÁ ËÏÔÏÒÙÈ ÂÕÄÕÔ ÕÓÔÁÎÏ×ÌÅÎÙ
	    ÍÅÔËÉ <acronym>MAC</acronym>, ÐÏÄÄÅÒÖÉ×ÁÀÔ ÐÁÒÁÍÅÔÒ
	    <option>multilabel</option>.  îÁÍ ÎÅÏÂÈÏÄÉÍÏ ÓÄÅÌÁÔØ ÜÔÏ,
	    ÐÏÓËÏÌØËÕ ÍÎÏÇÉÅ ÉÚ ÐÒÉÍÅÒÏ× ÚÄÅÓØ ÓÏÄÅÒÖÁÔ ÒÁÚÌÉÞÎÙÅ
	    ÍÅÔËÉ × ÃÅÌÑÈ ÔÅÓÔÉÒÏ×ÁÎÉÑ.  ðÒÏÓÍÏÔÒÉÔÅ ×Ù×ÏÄ ËÏÍÁÎÄÙ
	    <command>mount</command> × ËÁÞÅÓÔ×Å ÎÅÏÂÈÏÄÉÍÏÊ
	    ÐÒÅÄÏÓÔÏÒÏÖÎÏÓÔÉ.</para>
	</listitem>

	<listitem>
	  <para>ðÅÒÅËÌÀÞÉÔÅ ×ÓÅÈ ÐÏÌØÚÏ×ÁÔÅÌÅÊ, ËÏÔÏÒÙÅ ÂÕÄÕÔ ÉÓÐÏÌØÚÏ×ÁÔØ
	    ÎÏ×ÙÅ ÍÅÈÁÎÉÚÍÙ ÂÅÚÏÐÁÓÎÏÓÔÉ, ÎÁ ÜÔÏÔ ËÌÁÓÓ.  éÎÆÏÒÍÁÃÉÑ
	    ÐÏ ÜÔÏÊ ÐÒÏÃÅÄÕÒÅ ÎÁÈÏÄÉÔÓÑ × &man.pw.8; ÉÌÉ
	    &man.vipw.8;.</para>
	</listitem>
      </itemizedlist>
    </sect2>
  </sect1>

  <sect1 id="mac-partition">
    <title>íÏÄÕÌØ MAC partition</title>

    <indexterm>
      <primary>MAC Process Partition Policy</primary>
    </indexterm>
    <para>éÍÑ ÍÏÄÕÌÑ: <filename>mac_partition.ko</filename></para>

    <para>óÔÒÏËÁ ÎÁÓÔÒÏÊËÉ ÑÄÒÁ:
      <literal>options MAC_PARTITION</literal></para>

    <para>ðÁÒÁÍÅÔÒ ÚÁÇÒÕÚËÉ:
      <literal>mac_partition_load="YES"</literal></para>

    <para>ðÏÌÉÔÉËÁ &man.mac.partition.4; ÒÁÓÐÒÅÄÅÌÑÅÔ ÐÒÏÃÅÓÓÙ ÐÏ
      <quote>ÒÁÚÄÅÌÁÍ</quote> ÎÁ ÏÓÎÏ×Å ÉÈ <acronym>MAC</acronym>
      ÍÅÔÏË.  üÔÏ ÍÏÖÅÔ ÂÙÔØ ÐÒÅÄÓÔÁ×ÌÅÎÏ ËÁË ÏÓÏÂÙÊ ÔÉÐ
      &man.jail.8;, ÈÏÔÑ ÔÁËÏÅ ÓÒÁ×ÎÅÎÉÅ ÅÄ×Á ÌÉ ÐÏÄÈÏÄÉÔ.</para>

    <para>üÔÏÔ ÍÏÄÕÌØ ÄÏÌÖÅÎ ÂÙÔØ ÄÏÂÁ×ÌÅÎ × &man.loader.conf.5;,
      ÞÔÏÂÙ ÐÏÌÉÔÉËÁ ÂÙÌÁ ÚÁÇÒÕÖÅÎÁ É ×ËÌÀÞÅÎÁ ÐÒÉ ÚÁÇÒÕÚËÅ
      ÓÉÓÔÅÍÙ.</para>

    <para>âÏÌØÛÁÑ ÞÁÓÔØ ÎÁÓÔÒÏÊËÉ ÜÔÏÊ ÐÏÌÉÔÉËÉ ×ÙÐÏÌÎÑÅÔÓÑ Ó ÐÏÍÏÝØÀ
      ÕÔÉÌÉÔÙ &man.setpmac.8;, ËÏÔÏÒÁÑ ÂÕÄÅÔ ÏÐÉÓÁÎÁ ÎÉÖÅ.  äÌÑ
      ÄÁÎÎÏÊ ÐÏÌÉÔÉËÉ ÉÍÅÅÔÓÑ ÔÁËÖÅ ÓÌÅÄÕÀÝÁÑ ÐÅÒÅÍÅÎÎÁÑ
      <command>sysctl</command>:</para>

    <itemizedlist>
      <listitem>
	<para><literal>security.mac.partition.enabled</literal>
	  ×ËÌÀÞÉÔ <acronym>MAC</acronym> ÒÁÚÄÅÌÅÎÉÅ ÐÒÏÃÅÓÓÏ×.</para>
      </listitem>
    </itemizedlist>

    <para>ëÏÇÄÁ ÜÔÁ ÐÏÌÉÔÉËÁ ×ËÌÀÞÅÎÁ, ÐÏÌØÚÏ×ÁÔÅÌÑÍ ÒÁÚÒÅÛÅÎÏ
      ÐÒÏÓÍÁÔÒÉ×ÁÔØ ÔÏÌØËÏ ÓÏÂÓÔ×ÅÎÎÙÅ ÐÒÏÃÅÓÓÙ, ÎÏ ÎÅ ÒÁÚÒÅÛÅÎÏ
      ÐÏÌØÚÏ×ÁÔØÓÑ ÏÐÒÅÄÅÌÅÎÎÙÍÉ ÕÔÉÌÉÔÁÍÉ.  îÁÐÒÉÍÅÒ, ÐÏÌØÚÏ×ÁÔÅÌÀ
      ÉÚ ËÌÁÓÓÁ <literal>insecure</literal> ×ÙÛÅ ÎÅ ÂÕÄÅÔ ÒÁÚÒÅÛÅÎÏ
      ÉÓÐÏÌØÚÏ×ÁÎÉÅ ËÏÍÁÎÄÙ <command>top</command>, Á ÔÁËÖÅ ÍÎÏÇÉÈ
      ÄÒÕÇÉÈ ËÏÍÁÎÄ, ËÏÔÏÒÙÅ ÄÏÌÖÎÙ ÐÏÒÏÖÄÁÔØ ÐÒÏÃÅÓÓ.</para>

    <para>äÌÑ ÐÒÉÓ×ÏÅÎÉÑ ÕÔÉÌÉÔÁÍ ÍÅÔÏË partition ÉÓÐÏÌØÚÕÊÔÅ
      ÕÔÉÌÉÔÕ <command>setpmac</command>:</para>

    <screen>&prompt.root; <userinput>setpmac partition/13 top</userinput></screen>

    <para>ëÏÍÁÎÄÁ <command>top</command> ÂÕÄÅÔ ÄÏÂÁ×ÌÅÎÁ Ë ÍÅÔËÅ,
      ÕÓÔÁÎÏ×ÌÅÎÎÏÊ ÄÌÑ ÐÏÌØÚÏ×ÁÔÅÌÅÊ ËÌÁÓÓÁ <literal>insecure</literal>.
      ïÂÒÁÔÉÔÅ ×ÎÉÍÁÎÉÅ, ÞÔÏ ×ÓÅ ÐÒÏÃÅÓÓÙ, ÐÏÒÏÖÄÅÎÎÙÅ ÐÏÌØÚÏ×ÁÔÅÌÑÍÉ
      ËÌÁÓÓÁ <literal>insecure</literal>, ÏÓÔÁÎÕÔÓÑ Ó ÍÅÔËÏÊ
      <literal>partition/13</literal>.</para>

    <sect2>
      <title>ðÒÉÍÅÒÙ</title>

      <para>óÌÅÄÕÀÝÁÑ ËÏÍÁÎÄÁ ÐÏËÁÖÅÔ ×ÁÛÕ ÍÅÔËÕ ÒÁÚÄÅÌÁ É ÓÐÉÓÏË
	ÐÒÏÃÅÓÓÏ×:</para>

      <screen>&prompt.root; <userinput>ps Zax</userinput></screen>

      <para>óÌÅÄÕÀÝÅÊ ËÏÍÁÎÄÏÊ ÍÏÖÎÏ ÐÒÏÓÍÏÔÒÅÔØ ÍÅÔËÕ ÒÁÚÄÅÌÁ
	ÐÒÏÃÅÓÓÏ× ÄÒÕÇÉÈ ÐÏÌØÚÏ×ÁÔÅÌÅÊ É ÉÈ ÚÁÐÕÝÅÎÎÙÅ ÐÒÏÃÅÓÓÙ:</para>

      <screen>&prompt.root; <userinput>ps -ZU trhodes</userinput></screen>

      <note>
	<para>ðÏÌØÚÏ×ÁÔÅÌÉ ÍÏÇÕÔ ÍÏÇÕÔ Õ×ÉÄÅÔØ ÐÒÏÃÅÓÓÙ
	  <username>root</username>, ÅÓÌÉ ÎÅ ÚÁÇÒÕÖÅÎÁ ÐÏÌÉÔÉËÁ
	  &man.mac.seeotheruids.4;.</para>
      </note>

      <para>äÅÊÓÔ×ÉÔÅÌØÎÏ <quote>ÐÒÏÄ×ÉÎÕÔÁÑ</quote> ÒÅÁÌÉÚÁÃÉÑ
	ÄÏÌÖÎÁ ÏÔËÌÀÞÁÔØ ×ÓÅ ÓÅÒ×ÉÓÙ ÞÅÒÅÚ
	<filename>/etc/rc.conf</filename> É ÚÁÐÕÓËÁÔØ ÉÈ ÞÅÒÅÚ
	ÓËÒÉÐÔ, ËÏÔÏÒÙÊ ÕÓÔÁÎÏ×ÉÔ ÐÒÁ×ÉÌØÎÙÊ ÎÁÂÏÒ ÍÅÔÏË.</para>

      <note>
	<para>óÌÅÄÕÀÝÉÅ ÐÏÌÉÔÉËÉ ÐÏÄÄÅÒÖÉ×ÁÀÔ ÃÅÌÏÞÉÓÌÅÎÎÙÅ ÕÓÔÁÎÏ×ËÉ
	  ×ÍÅÓÔÏ ÔÒÅÈ ÍÅÔÏË ÐÏ ÕÍÏÌÞÁÎÉÀ.  üÔÉ ÏÐÃÉÉ, ×ËÌÀÞÁÑ ÉÈ
	  ÏÇÒÁÎÉÞÅÎÉÑ, ÏÐÉÓÙ×ÁÀÔÓÑ ÂÏÌÅÅ ÐÏÄÒÏÂÎÏ × ÓÔÒÁÎÉÃÁÈ
	  ÓÐÒÁ×ÏÞÎÉËÁ ÍÏÄÕÌÅÊ.</para>
      </note>
    </sect2>
  </sect1>

  <sect1 id="mac-mls">
    <title>íÏÄÕÌØ ÍÎÏÇÏÕÒÏ×ÎÅ×ÏÊ ÂÅÚÏÐÁÓÎÏÓÔÉ MAC (MLS)</title>

    <indexterm>
      <primary>ðÏÌÉÔÉËÁ ÍÎÏÇÏÕÒÏ×ÎÅ×ÏÊ ÂÅÚÏÐÁÓÎÏÓÔÉ MAC</primary>
    </indexterm>
    <para>éÍÑ ÍÏÄÕÌÑ: <filename>mac_mls.ko</filename></para>

    <para>óÔÒÏËÁ ËÏÎÆÉÇÕÒÁÃÉÉ ÑÄÒÁ:
      <literal>options MAC_MLS</literal></para>

    <para>ðÁÒÁÍÅÔÒ ÚÁÇÒÕÚËÉ: <literal>mac_mls_load="YES"</literal></para>

    <para>ðÏÌÉÔÉËÁ &man.mac.mls.4; ËÏÎÔÒÏÌÉÒÕÅÔ ×ÚÁÉÍÏÄÅÊÓÔ×ÉÅ ÓÕÂßÅËÔÏ×
      É ÏÂßÅËÔÏ× ÓÉÓÔÅÍÙ ÐÕÔÅÍ ÐÒÉÍÅÎÅÎÉÑ ÓÔÒÏÇÏÊ ÐÏÌÉÔÉËÉ
      Ë ÐÏÔÏËÕ ÉÎÆÏÒÍÁÃÉÉ.</para>

    <para>÷ ÓÒÅÄÅ <acronym>MLS</acronym>, ÄÌÑ ËÁÖÄÏÇÏ ÓÕÂßÅËÔÁ ÉÌÉ ÏÂßÅËÔÁ
      ×ÎÕÔÒÉ ÏÔÄÅÌÁ (compartment) ÕÓÔÁÎÁ×ÌÉ×ÁÅÔÓÑ <quote>ÕÒÏ×ÅÎØ
      ÄÏÐÕÓËÁ</quote>.  ðÏÓËÏÌØËÕ ËÏÌÉÞÅÓÔ×Ï ÕÒÏ×ÎÅÊ ÄÏÐÕÓËÁ ÍÏÖÅÔ
      ÐÒÅ×ÙÛÁÔØ ÛÅÓÔØ ÔÙÓÑÞ, ÄÌÑ ÌÀÂÏÇÏ ÓÉÓÔÅÍÎÏÇÏ ÁÄÍÉÎÉÓÔÒÁÔÏÒÁ
      ÚÁÄÁÞÁ ÎÁÓÔÒÏÊËÉ ËÁÖÄÏÇÏ ÓÕÂßÅËÔÁ ÉÌÉ ÏÂßÅËÔÁ ÍÏÖÅÔ ÂÙÔØ
      ÓÌÉÛËÏÍ ÓÌÏÖÎÏÊ.  ë ÓÞÁÓÔØÀ, ÓÕÝÅÓÔ×ÕÀÔ <quote>ÐÏÓÔÏÑÎÎÙÅ</quote>
      ÍÅÔËÉ, ËÏÔÏÒÙÅ ÕÖÅ ×ËÌÀÞÅÎÙ × ÜÔÕ ÐÏÌÉÔÉËÕ.</para>

    <para>üÔÉ ÍÅÔËÉ <literal>mls/low</literal>,
      <literal>mls/equal</literal> É <literal>mls/high</literal>.
      ðÏÓËÏÌØËÕ ÜÔÉ ÍÅÔËÉ ÐÏÄÒÏÂÎÏ ÏÐÉÓÙ×ÁÀÔÓÑ × ÓÐÒÁ×ÏÞÎÉËÅ,
      ÚÄÅÓØ ÍÙ ÄÁÄÉÍ ÔÏÌØËÏ ËÒÁÔËÏÅ ÏÐÉÓÁÎÉÅ:</para>

    <itemizedlist>
      <listitem>
	<para>íÅÔËÁ <literal>mls/low</literal> ÓÏÄÅÒÖÉÔ ÍÉÎÉÍÁÌØÎÕÀ
	  ÎÁÓÔÒÏÊËÕ, ÞÔÏ ÐÏÚ×ÏÌÑÅÔ ÄÏÍÉÎÉÒÏ×ÁÎÉÅ ÎÁÄ ÎÅÊ ×ÓÅÈ ÄÒÕÇÉÈ
	  ÏÂßÅËÔÏ×.  ÷ÓÅ, ÞÔÏ ÐÏÍÅÞÅÎÏ Ó <literal>mls/low</literal>,
	  ÎÁÈÏÄÉÔÓÑ ÎÁ ÎÉÚËÏÍ ÕÒÏ×ÎÅ ÄÏÓÔÕÐÁ É ÄÏÓÔÕÐ Ë ÂÏÌÅÅ ×ÙÓÏËÉÍ
	  ÕÒÏ×ÎÑÍ ÂÕÄÅÔ ÚÁÐÒÅÝÅÎ.  ëÒÏÍÅ ÔÏÇÏ, ÜÔÁ ÍÅÔËÁ ÐÒÅÄÏÔ×ÒÁÔÉÔ
	  ÚÁÐÉÓØ ÉÌÉ ÐÅÒÅÄÁÞÕ ÉÎÆÏÒÍÁÃÉÉ ÏÂßÅËÔÁÍ Ó ÂÏÌÅÅ ×ÙÓÏËÉÍ
	  ÕÒÏ×ÎÅÍ ÄÏÓÔÕÐÁ.</para>
      </listitem>

      <listitem>
	<para>íÅÔËÁ <literal>mls/equal</literal> ÄÏÌÖÎÁ ÂÙÔØ ÐÏÍÅÝÅÎÁ
	  ÎÁ ÏÂßÅËÔÙ, Ñ×ÌÑÀÝÉÅÓÑ ÉÓËÌÀÞÅÎÉÅÍ ÉÚ ÐÏÌÉÔÉËÉ.</para>
      </listitem>

      <listitem>
	<para>íÅÔËÁ <literal>mls/high</literal> ÜÔÏ ÎÁÉÂÏÌØÛÉÊ ×ÏÚÍÏÖÎÙÊ
	  ÕÒÏ×ÅÎØ ÄÏÓÔÕÐÁ.  ïÂßÅËÔÙ Ó ÜÔÏÊ ÍÅÔËÏÊ ÂÕÄÕÔ ÄÏÍÉÎÉÒÏ×ÁÔØ
	  ÎÁÄ ×ÓÅÍÉ ÄÒÕÇÉÍÉ ÏÂßÅËÔÁÍÉ ÓÉÓÔÅÍÙ; ÏÄÎÁËÏ, ÕÔÅÞËÁ ÉÎÆÏÒÍÁÃÉÉ
	  ÏÔ ÎÉÈ Ë ÏÂßÅËÔÁÍ ÂÏÌÅÅ ÎÉÚËÏÇÏ ËÌÁÓÓÁ ÎÅ×ÏÚÍÏÖÎÁ.</para>
      </listitem>
    </itemizedlist>

    <para><acronym>MLS</acronym> ÐÒÅÄÓÔÁ×ÌÑÅÔ ÓÏÂÏÊ:</para>

    <itemizedlist>
      <listitem>
	<para>éÅÒÁÒÈÉÞÅÓËÉÅ ÕÒÏ×ÎÉ ÂÅÚÏÐÁÓÎÏÓÔÉ Ó ÎÁÂÏÒÏÍ ÎÅ
	  ÉÅÒÁÒÈÉÞÅÓËÉÈ ËÁÔÅÇÏÒÉÊ;</para>
      </listitem>

      <listitem>
	<para>æÉËÓÉÒÏ×ÁÎÎÙÅ ÐÒÁ×ÉÌÁ: ÎÅÔ ÞÔÅÎÉÑ Ó×ÅÒÈÕ, ÎÅÔ ÚÁÐÉÓÉ
	  ×ÎÉÚ (ÓÕÂßÅËÔ ÍÏÖÅÔ ÉÍÅÔØ ÄÏÓÔÕÐ ÎÁ ÞÔÅÎÉÅ ÏÂßÅËÔÏ×
	  ÓÏÂÓÔ×ÅÎÎÏÇÏ ÕÒÏ×ÎÑ ÉÌÉ ÎÉÖÅ, ÎÏ ÎÅ ×ÙÛÅ.  áÎÁÌÏÇÉÞÎÏ,
	  ÓÕÂßÅËÔ ÍÏÖÅÔ ÉÍÅÔØ ÄÏÓÔÕÐ ÎÁ ÚÁÐÉÓØ × ÏÂßÅËÔÙ Ó×ÏÅÇÏ
	  ÕÒÏ×ÎÑ ÉÌÉ ×ÙÛÅ, ÎÏ ÎÅ ÎÁÏÂÏÒÏÔ.);</para>
      </listitem>

      <listitem>
	<para>óÅËÒÅÔÎÏÓÔØ (ÐÒÅÄÏÔ×ÒÁÝÅÎÉÅ ÎÅÁ×ÔÏÒÉÚÏ×ÁÎÎÏÇÏ ÒÁÓËÒÙÔÉÑ
	  ÄÁÎÎÙÈ);</para>
      </listitem>

      <listitem>
	<para>ïÓÎÏ×Á ÄÌÑ ÒÁÚÒÁÂÏÔËÉ ÓÉÓÔÅÍ, ÏÄÎÏ×ÒÅÍÅÎÎÏ ÒÁÂÏÔÁÀÝÉÈ Ó
	  ÄÁÎÎÙÍÉ ÎÁ ÎÅÓËÏÌØËÉÈ ÕÒÏ×ÎÑÈ ÓÅËÒÅÔÎÏÓÔÉ (ÂÅÚ ÕÔÅÞËÉ
	  ÉÎÆÏÒÍÁÃÉÉ).<!--between secret and confidential--></para>
      </listitem>
    </itemizedlist>

    <para>äÌÑ ÎÁÓÔÒÏÊËÉ ÓÐÅÃÉÁÌØÎÙÈ ÓÅÒ×ÉÓÏ× É ÉÎÔÅÒÆÅÊÓÏ× ÄÏÓÔÕÐÎÙ
      ÓÌÅÄÕÀÝÉÅ ÐÅÒÅÍÅÎÎÙÅ <command>sysctl</command>:</para>

    <itemizedlist>
      <listitem>
	<para><literal>security.mac.mls.enabled</literal> ÉÓÐÏÌØÚÕÅÔÓÑ
	  ÄÌÑ ×ËÌÀÞÅÎÉÑ/ÏÔËÌÀÞÅÎÉÑ ÐÏÌÉÔÉËÉ <acronym>MLS</acronym>.</para>
      </listitem>

      <listitem>
	<para><literal>security.mac.mls.ptys_equal</literal> ÐÏÍÅÔÉÔ
	  ×ÓÅ ÕÓÔÒÏÊÓÔ×Á &man.pty.4; ËÁË <literal>mls/equal</literal>
	  ×Ï ×ÒÅÍÑ ÓÏÚÄÁÎÉÑ.</para>
      </listitem>

      <listitem>
	<para><literal>security.mac.mls.revocation_enabled</literal>
	  ÉÓÐÏÌØÚÕÅÔÓÑ ÄÌÑ ÚÁÐÒÅÔÁ ÄÏÓÔÕÐÁ Ë ÏÂßÅËÔÁÍ ÐÏÓÌÅ ÔÏÇÏ,
	  ËÁË ÉÈ ÍÅÔËÁ ÉÚÍÅÎÉÔÓÑ × ÍÅÎØÛÕÀ ÓÔÏÒÏÎÕ.</para>
      </listitem>

      <listitem>
	<para><literal>security.mac.mls.max_compartments</literal>
	  ÉÓÐÏÌØÚÕÅÔÓÑ ÄÌÑ ÕÓÔÁÎÏ×ËÉ ÍÁËÓÉÍÁÌØÎÏÇÏ ËÏÌÉÞÅÓÔ×Á
	  ÕÒÏ×ÎÅÊ ÏÔÄÅÌÏ× ÎÁ ÏÂßÅËÔÙ; ÏÂÙÞÎÏ ÜÔÏ ÍÁËÓÉÍÁÌØÎÏÅ
	  ËÏÌÉÞÅÓÔ×Ï ÏÔÄÅÌÏ×, ÒÁÚÒÅÛÅÎÎÙÈ × ÓÉÓÔÅÍÅ.</para>
      </listitem>
    </itemizedlist>

    <para>äÌÑ ÕÐÒÁ×ÌÅÎÉÑ ÍÅÔËÁÍÉ <acronym>MLS</acronym> ÓÕÝÅÓÔ×ÕÅÔ ËÏÍÁÎÄÁ
      &man.setfmac.8;.  äÌÑ ÐÒÉÓ×ÏÅÎÉÑ ÍÅÔËÉ ÏÂßÅËÔÕ, ×ÙÐÏÌÎÉÔÅ
      ÓÌÅÄÕÀÝÕÀ ËÏÍÁÎÄÕ:</para>

    <screen>&prompt.root; <userinput>setfmac mls/5 test</userinput></screen>

    <para>äÌÑ ÐÏÌÕÞÅÎÉÑ ÍÅÔËÉ <acronym>MLS</acronym> ÆÁÊÌÁ
      <filename>test</filename>, ×ÙÐÏÌÎÉÔÅ ÓÌÅÄÕÀÝÕÀ ËÏÍÁÎÄÕ:</para>

    <screen>&prompt.root; <userinput>getfmac test</userinput></screen>

    <para>÷ÙÛÅ ÐÒÅÄÓÔÁ×ÌÅÎ ËÒÁÔËÉÊ ÏÂÚÏÒ ×ÏÚÍÏÖÎÏÓÔÅÊ ÐÏÌÉÔÉËÉ
      <acronym>MLS</acronym>.  óÕÝÅÓÔ×ÕÅÔ ÍÅÔÏÄ, Ó×ÑÚÁÎÎÙÊ Ó ÓÏÚÄÁÎÉÅÍ
      ÏÓÎÏ×ÎÏÇÏ ÆÁÊÌÁ ÐÏÌÉÔÉËÉ × ËÁÔÁÌÏÇÅ <filename
      class="directory">/etc</filename>, ÇÄÅ ÂÕÄÅÔ ÏÐÒÅÄÅÌÅÎÁ
      ÎÅÏÂÈÏÄÉÍÁÑ ÄÌÑ ÐÏÌÉÔÉËÉ <acronym>MLS</acronym> ÉÎÆÏÒÍÁÃÉÑ, ËÏÔÏÒÁÑ
      ÂÕÄÅÔ ÐÅÒÅÄÁÎÁ ËÏÍÁÎÄÅ <command>setfmac</command>.  üÔÏÔ ÍÅÔÏÄ ÂÕÄÅÔ
      ÏÐÉÓÁÎ ÐÏÓÌÅ ÒÁÓÓÍÏÔÒÅÎÉÑ ×ÓÅÈ ÐÏÌÉÔÉË.</para>

    <para>éÔÏÇÉ: ÏÂßÅËÔ Ó ÎÉÚËÉÍ ÕÒÏ×ÎÅÍ ÄÏÓÔÕÐÁ ÎÅ ÍÏÖÅÔ
      ÐÒÏÞÅÓÔØ ÄÁÎÎÙÅ ÏÂßÅËÔÁ Ó ×ÙÓÏËÉÍ ÕÒÏ×ÎÅÍ ÄÏÓÔÕÐÁ.  âÁÚÏ×ÁÑ ÐÏÌÉÔÉËÁ
      ÄÏÌÖÎÁ ÕÓÔÁÎÁ×ÌÉ×ÁÔØ <literal>mls/high</literal> ÎÁ ×ÓÅÍ, ÞÔÏ ÎÅ ÄÏÌÖÎÏ
      ÂÙÔØ ÐÒÏÞÉÔÁÎÏ, ÄÁÖÅ ÅÓÌÉ ÔÕÄÁ ÎÅÏÂÈÏÄÉÍÏ ÚÁÐÉÓÙ×ÁÔØ.  îÁ ×ÓÅÍ, ËÕÄÁ
      ÎÅÌØÚÑ ÐÉÓÁÔØ, ÄÏÌÖÎÁ ÂÙÔØ ÕÓÔÁÎÏ×ÌÅÎÁ ÍÅÔËÁ
      <literal>mls/low</literal>, ÄÁÖÅ ÅÓÌÉ ÜÔÏ ÎÅÏÂÈÏÄÉÍÏ ÞÉÔÁÔØ.
      îÁËÏÎÅÃ, ÎÁ ×ÓÅÍ ÏÓÔÁÌØÎÏÍ ÕÓÔÁÎÏ×ÉÔÅ <literal>mls/equal</literal>.
      ÷ÓÅ ÐÏÌØÚÏ×ÁÔÅÌÉ, ÐÏÍÅÞÅÎÎÙÅ ËÁË <literal>insecure</literal>, ÄÏÌÖÎÙ
      ÉÍÅÔØ ÍÅÔËÕ <literal>mls/low</literal>.</para>
  </sect1>

  <sect1 id="mac-biba">
    <title>íÏÄÕÌØ MAC Biba</title>

    <indexterm>
      <primary>MAC Biba Integrity Policy</primary>
    </indexterm>
    <para>éÍÑ ÍÏÄÕÌÑ: <filename>mac_biba.ko</filename></para>

    <para>óÔÒÏËÁ ËÏÎÆÉÇÕÒÁÃÉÉ ÑÄÒÁ: <literal>options MAC_BIBA</literal></para>

    <para>ðÁÒÁÍÅÔÒ ÚÁÇÒÕÚËÉ: <literal>mac_biba_load="YES"</literal></para>

    <para>íÏÄÕÌØ &man.mac.biba.4; ÚÁÇÒÕÖÁÅÔ <acronym>MAC</acronym>
      ÐÏÌÉÔÉËÕ Biba.  üÔÁ ÐÏÌÉÔÉËÁ ÒÁÂÏÔÁÅÔ × ÏÓÎÏ×ÎÏÍ ÔÁË ÖÅ, ËÁË É
      <acronym>MLS</acronym>, ÚÁ ÉÓËÌÀÞÅÎÉÅÍ ÔÏÇÏ, ÞÔÏ ÐÒÁ×ÉÌÁ ÐÏÔÏËÁ
      ÉÎÆÏÒÍÁÃÉÉ ÉÚÍÅÎÅÎÙ ÎÁ ÐÒÏÔÉ×ÏÐÏÌÏÖÎÙÅ.  ïÎÉ ÐÒÅÄÎÁÚÎÁÞÅÎÙ ÄÌÑ
      ÐÒÅÄÏÔ×ÒÁÝÅÎÉÑ ÐÅÒÅÄÁÞÉ ÐÏÔÏËÁ ÓÅËÒÅÔÎÏÊ ÉÎÆÏÒÍÁÃÉÉ ××ÅÒÈ, × ÔÏ
      ×ÒÅÍÑ ËÁË ÐÏÌÉÔÉËÁ <acronym>MLS</acronym> ÐÒÅÄÏÔ×ÒÁÝÁÅÔ ÐÅÒÅÄÁÞÕ
      ÐÏÔÏËÁ ÓÅËÒÅÔÎÏÊ ÉÎÆÏÒÍÁÃÉÉ ×ÎÉÚ; ÔÁËÉÍ ÏÂÒÁÚÏÍ, ÂÏÌØÛÁÑ ÞÁÓÔØ
      ÜÔÏÇÏ ÒÁÚÄÅÌÁ ÐÒÉÍÅÎÉÍÁ Ë ÏÂÅÉÍ ÐÏÌÉÔÉËÁÍ.</para>

    <para>÷ ÓÒÅÄÅ Biba, ËÁÖÄÏÍÕ ÓÕÂßÅËÔÕ ÉÌÉ ÏÂßÅËÔÕ ÐÒÉÓ×ÁÉ×ÁÅÔÓÑ
      ÍÅÔËÁ <quote>ÃÅÌÏÓÔÎÏÓÔÉ</quote>.  üÔÉ ÍÅÔËÉ ÓÏÓÔÏÑÔ ÉÚ
      ÉÅÒÁÒÈÉÞÅÓËÉÈ ÕÒÏ×ÎÅÊ É ÎÅ-ÉÅÒÁÒÈÉÞÅÓËÉÈ ËÏÍÐÏÎÅÎÔÏ×.
      ðÒÉ ×ÏÚÒÁÓÔÁÎÉÉ ÕÒÏ×ÎÑ ÏÂßÅËÔÁ ÉÌÉ ÓÕÂßÅËÔÁ ÜÔÏ ÐÏ×ÙÛÁÅÔ
      ÅÇÏ ÃÅÌÏÓÔÎÏÓÔØ.</para>

    <para>ðÏÄÄÅÒÖÉ×ÁÅÍÙÅ ÍÅÔËÉ <literal>biba/low</literal>,
      <literal>biba/equal</literal>, É <literal>biba/high</literal>;
      ÏÐÉÓÁÎÙ ÎÉÖÅ:</para>

    <itemizedlist>
      <listitem>
	<para>íÅÔËÁ <literal>biba/low</literal> ÏÂÅÓÐÅÞÉ×ÁÅÔ ÎÁÉÍÅÎØÛÕÀ
	  ÃÅÌÏÓÔÎÏÓÔØ ÏÂßÅËÔÁ ÉÌÉ ÓÕÂßÅËÔÁ.  õÓÔÁÎÏ×ËÁ ÅÅ ÎÁ ÏÂßÅËÔ
	  ÉÌÉ ÓÕÂßÅËÔ ÚÁÂÌÏËÉÒÕÅÔ ÉÈ ÄÏÓÔÕÐ Ë ÏÂßÅËÔÁÍ ÉÌÉ ÓÕÂßÅËÔÁÍ,
	  ÉÍÅÀÝÉÍ ÂÏÌÅÅ ×ÙÓÏËÕÀ ÍÅÔËÕ.  ôÅÍ ÎÅ ÍÅÎÅÅ, Õ ÎÉÈ ÏÓÔÁÅÔÓÑ
	  ÄÏÓÔÕÐ ÎÁ ÞÔÅÎÉÅ.</para>
      </listitem>

      <listitem>
	<para>íÅÔËÁ <literal>biba/equal</literal> ÄÏÌÖÎÁ ÐÏÍÅÝÁÔØÓÑ ÔÏÌØËÏ
	  ÎÁ ÏÂßÅËÔÙ, ÉÓËÌÀÞÁÀÝÉÅÓÑ ÉÚ ÐÏÌÉÔÉËÉ.</para>
      </listitem>

      <listitem>
	<para>íÅÔËÁ <literal>biba/high</literal> ÒÁÚÒÅÛÉÔ ÚÁÐÉÓØ × ÏÂßÅËÔÙ
	  Ó ÂÏÌÅÅ ÎÉÚËÏÊ ÍÅÔËÏÊ, ÎÏ ÎÅ ÒÁÚÒÅÛÉÔ ÞÔÅÎÉÅ ÉÚ ÜÔÉÈ
	  ÏÂßÅËÔÏ×.  òÅËÏÍÅÎÄÕÅÔÓÑ ÐÏÍÅÝÁÔØ ÔÁËÕÀ ÍÅÔËÕ ÎÁ ÏÂßÅËÔÙ,
	  ×ÌÉÑÀÝÉÅ ÎÁ ÃÅÌÏÓÔÎÏÓÔØ ×ÓÅÊ ÓÉÓÔÅÍÙ.</para>
      </listitem>
    </itemizedlist>

    <para>Biba ÐÒÅÄÓÔÁ×ÌÑÅÔ ÓÏÂÏÊ:</para>

    <itemizedlist>
      <listitem>
	<para>éÅÒÁÒÈÉÞÅÓËÉÅ ÕÒÏ×ÎÉ ÃÅÌÏÓÔÎÏÓÔÉ Ó ÎÁÂÏÒÏÍ ÎÅ ÉÅÒÁÒÈÉÞÅÓËÉÈ
	  ËÁÔÅÇÏÒÉÊ;</para>
      </listitem>

      <listitem>
	<para>æÉËÓÉÒÏ×ÁÎÎÙÅ ÐÒÁ×ÉÌÁ: ÎÅÔ ÚÁÐÉÓÉ ÎÁ×ÅÒÈ, ÎÅÔ ÞÔÅÎÉÑ ÓÎÉÚÕ
	  (ÏÂÒÁÔÎÏ <acronym>MLS</acronym>).  óÕÂßÅËÔ ÍÏÖÅÔ ÉÍÅÔØ ÄÏÓÔÕÐ ÎÁ
	  ÚÁÐÉÓØ Ë ÏÂßÅËÔÁÍ Ó×ÏÅÇÏ ÕÒÏ×ÎÑ ÉÌÉ ÎÉÖÅ, ÎÏ ÎÅ ×ÙÛÅ.  áÎÁÌÏÇÉÞÎÏ,
	  ÓÕÂßÅËÔ ÍÏÖÅÔ ÉÍÅÔØ ÄÏÓÔÕÐ ÎÁ ÞÔÅÎÉÅ Ë ÏÂßÅËÔÁÍ Ó×ÏÅÇÏ ÕÒÏ×ÎÑ
	  ÉÌÉ ×ÙÛÅ, ÎÏ ÎÅ ÎÉÖÅ;</para>
      </listitem>

      <listitem>
	<para>ãÅÌÏÓÔÎÏÓÔØ (ÐÒÅÄÏÔ×ÒÁÝÅÎÉÅ ÎÅÁ×ÔÏÒÉÚÏ×ÁÎÎÏÇÏ ÉÚÍÅÎÅÎÉÑ
	  ÄÁÎÎÙÈ);</para>
      </listitem>

      <listitem>
	<para>õÒÏ×ÎÉ ÃÅÌÏÓÔÎÏÓÔÉ (×ÍÅÓÔÏ ÕÒÏ×ÎÅÊ ÓÅËÒÅÔÎÏÓÔÉ
	  MLS).</para>
      </listitem>
    </itemizedlist>

    <para>äÌÑ ÕÐÒÁ×ÌÅÎÉÑ ÐÏÌÉÔÉËÏÊ Biba ÍÏÇÕÔ ÂÙÔØ ÉÓÐÏÌØÚÏ×ÁÎÙ
      ÓÌÅÄÕÀÝÉÅ ÐÅÒÅÍÅÎÎÙÅ <command>sysctl</command>:</para>

    <itemizedlist>
      <listitem>
	<para><literal>security.mac.biba.enabled</literal>
	  ÍÏÖÅÔ ÉÓÐÏÌØÚÏ×ÁÔØÓÑ ÄÌÑ ×ËÌÀÞÅÎÉÑ/×ÙËÌÀÞÅÎÉÑ ÐÏÌÉÔÉËÉ
	  Biba.</para>
      </listitem>

      <listitem>
	<para><literal>security.mac.biba.ptys_equal</literal>
	  ÍÏÖÅÔ ÉÓÐÏÌØÚÏ×ÁÔØÓÑ ÄÌÑ ÏÔËÌÀÞÅÎÉÑ ÐÏÌÉÔÉËÉ Biba
	  ÎÁ ÕÓÔÒÏÊÓÔ×ÁÈ &man.pty.4;.</para>
      </listitem>

      <listitem>
	<para><literal>security.mac.biba.revocation_enabled</literal>
	  ×ËÌÀÞÉÔ ÏÔÍÅÎÕ ÄÏÓÔÕÐÁ Ë ÏÂßÅËÔÁÍ, ÅÓÌÉ ÍÅÔËÁ ÉÚÍÅÎÅÎÁ
	  ÎÁ ÂÏÌÅÅ ×ÙÓÏËÕÀ, ÞÅÍ Õ ÓÕÂßÅËÔÁ.</para>
      </listitem>
    </itemizedlist>

    <para>äÌÑ ×ÙÐÏÌÎÅÎÉÑ ÎÁÓÔÒÏÅË ÐÏÌÉÔÉËÉ Biba ÎÁ ÓÉÓÔÅÍÎÙÈ
      ÏÂßÅËÔÁÈ, ÐÒÉÍÅÎÑÀÔÓÑ ËÏÍÁÎÄÙ <command>setfmac</command> É
      <command>getfmac</command>:</para>

    <screen>&prompt.root; <userinput>setfmac biba/low test</userinput>
&prompt.root; <userinput>getfmac test</userinput>
test: biba/low</screen>

    <para>éÔÏÇÉ: ÓÕÂßÅËÔ Ó ÎÉÚËÉÍ ÕÒÏ×ÎÅÍ ÃÅÌÏÓÔÎÏÓÔÉ ÎÅ ÍÏÖÅÔ ÐÉÓÁÔØ
      × ÓÕÂßÅËÔ Ó ×ÙÓÏËÉÍ ÕÒÏ×ÎÅÍ ÃÅÌÏÓÔÎÏÓÔÉ; ÓÕÂßÅËÔ Ó ×ÙÓÏËÉÍ ÕÒÏ×ÎÅÍ
      ÃÅÌÏÓÔÎÏÓÔÉ ÎÅ ÍÏÖÅÔ ÞÉÔÁÔØ ÉÚ ÓÕÂßÅËÔÁ Ó ÎÉÚËÉÍ ÕÒÏ×ÎÅÍ
      ÃÅÌÏÓÔÎÏÓÔÉ.</para>
  </sect1>

  <sect1 id="mac-lomac">
    <title>íÏÄÕÌØ MAC LOMAC</title>

    <indexterm>
      <primary>MAC LOMAC</primary>
    </indexterm>
    <para>éÍÑ ÍÏÄÕÌÑ: <filename>mac_lomac.ko</filename></para>

    <para>óÔÒÏËÁ ËÏÎÆÉÇÕÒÁÃÉÉ ÑÄÒÁ: <literal>options MAC_LOMAC</literal></para>
    <para>ðÁÒÁÍÅÔÒ ÚÁÇÒÕÚËÉ: <literal>mac_lomac_load="YES"</literal></para>

    <para>÷ ÏÔÌÉÞÉÅ ÏÔ ÐÏÌÉÔÉËÉ <acronym>MAC</acronym> Biba, ÐÏÌÉÔÉËÁ
      &man.mac.lomac.4; ÒÁÚÒÅÛÁÅÔ ÄÏÓÔÕÐ Ë ÏÂßÅËÔÁÍ Ó ÂÏÌÅÅ ÎÉÚËÉÍ ÕÒÏ×ÎÅÍ
      ÃÅÌÏÓÔÎÏÓÔÉ ÔÏÌØËÏ ÐÏÓÌÅ ÕÍÅÎØÛÅÎÉÑ ÕÒÏ×ÎÑ ÃÅÌÏÓÔÎÏÓÔÉ, ÞÔÏÂÙ ÎÅ
      ÎÁÒÕÛÁÔØ ËÁËÉÈ-ÌÉÂÏ ÐÒÁ×ÉÌ ÃÅÌÏÓÔÎÏÓÔÉ.</para>

    <para><acronym>MAC</acronym> ×ÅÒÓÉÑ ÐÏÌÉÔÉËÉ ÃÅÌÏÓÔÎÏÓÔÉ Low-watermark,
      ÞÔÏÂÙ ÎÅ ÐÅÒÅÓÅËÁÔØÓÑ ÓÏ ÓÔÁÒÏÊ ÒÅÁÌÉÚÁÃÉÅÊ  &man.lomac.4;,
      ÒÁÂÏÔÁÅÔ ÐÏÞÔÉ ÔÁË ÖÅ, ËÁË É Biba, ÚÁ ÉÓËÌÀÞÅÎÉÅÍ ÉÓÐÏÌØÚÏ×ÁÎÉÑ
      ÐÌÁ×ÁÀÝÉÈ ÍÅÔÏË ÄÌÑ ÐÏÄÄÅÒÖËÉ ÐÏÎÉÖÅÎÉÑ ÍÅÔËÉ ÓÕÂßÅËÔÁ ÞÅÒÅÚ
      ÏÔÄÅÌ ÄÌÑ ×ÓÐÏÍÏÇÁÔÅÌØÎÏÊ ÇÒÁÄÁÃÉÉ (auxiliary grade compartment).
      üÔÏÔ ×ÓÐÏÍÏÇÁÔÅÌØÎÙÊ ÏÔÄÅÌ ÐÒÉÎÉÍÁÅÔ ×ÉÄ <literal>[auxgrade]</literal>.
      ðÒÉ ×ËÌÀÞÅÎÉÉ ÐÏÌÉÔÉËÉ lomac Ó ×ÓÐÏÍÏÇÁÔÅÌØÎÏÊ ÇÒÁÄÁÃÉÅÊ
      ÍÅÔËÁ ÄÏÌÖÎÁ ×ÙÇÌÑÄÅÔØ ÐÒÉÂÌÉÚÉÔÅÌØÎÏ ÔÁË:
      <literal>lomac/10[2]</literal>, ÇÄÅ ÎÏÍÅÒ 2 ÜÔÏ ×ÓÐÏÍÏÇÁÔÅÌØÎÁÑ
      ÇÒÁÄÁÃÉÑ.</para>

    <para>ðÏÌÉÔÉËÁ <acronym>MAC</acronym> LOMAC ÏÓÎÏ×ÁÎÁ ÎÁ ÔÏÔÁÌØÎÏÊ
      ÐÏÍÅÔËÅ ×ÓÅÈ ÓÉÓÔÅÍÎÙÈ ÏÂßÅËÔÏ× ÍÅÔËÁÍÉ ÃÅÌÏÓÔÎÏÓÔÉ, ÒÁÚÒÅÛÁÑ
      ÓÕÂßÅËÔÁÍ ÞÉÔÁÔØ ÉÚ ÏÂßÅËÔÏ× Ó ÂÏÌÅÅ ÎÉÚËÏÊ ÓÔÅÐÅÎØÀ ÃÅÌÏÓÔÎÏÓÔÉ
      É Ó ÕÍÅÎØÛÅÎÉÅÍ ÍÅÔËÉ ÓÕÂßÅËÔÁ ÄÌÑ ÐÒÅÄÏÔ×ÒÁÝÅÎÉÑ ÐÏÓÌÅÄÕÀÝÅÊ
      ÚÁÐÉÓÉ × ÏÂßÅËÔÙ Ó ÂÏÌÅÅ ×ÙÓÏËÏÊ ÓÔÅÐÅÎØÀ ÃÅÌÏÓÔÎÏÓÔÉ.
      ðÁÒÁÍÅÔÒ <literal>[auxgrade]</literal> ÏÂÓÕÖÄÁÌÓÑ ×ÙÛÅ, ÔÁËÉÍ
      ÏÂÒÁÚÏÍ ÐÏÌÉÔÉËÁ ÍÏÖÅÔ ÂÙÔØ ÂÏÌÅÅ ÓÏ×ÍÅÓÔÉÍÏÊ É ÔÒÅÂÏ×ÁÔØ
      ÍÅÎØÛÅÊ ÐÅÒ×ÏÎÁÞÁÌØÎÏÊ ÎÁÓÔÒÏÊËÉ, ÞÅÍ Biba.</para>

    <sect2>
      <title>ðÒÉÍÅÒÙ</title>

      <para>ëÁË É ÄÌÑ ÐÏÌÉÔÉË Biba É <acronym>MLS</acronym>, ÄÌÑ
	ÕÓÔÁÎÏ×ËÉ ÍÅÔÏË ÎÁ ÓÉÓÔÅÍÎÙÅ ÏÂßÅËÔÙ É ÓÕÂßÅËÔÙ ÍÏÇÕÔ
	ÂÙÔØ ÉÓÐÏÌØÚÏ×ÁÎÙ ÕÔÉÌÉÔÙ <command>setfmac</command> É
	<command>setpmac</command>:</para>

      <screen>&prompt.root; <userinput>setfmac /usr/home/trhodes lomac/high[low]</userinput>
&prompt.root; <userinput>getfmac /usr/home/trhodes</userinput> lomac/high[low]</screen>

      <para>ïÂÒÁÔÉÔÅ ×ÎÉÍÁÎÉÅ, ÞÔÏ ×ÓÐÏÍÏÇÁÔÅÌØÎÁÑ ÇÒÁÄÁÃÉÑ ÚÄÅÓØ
	<literal>low</literal>, ÜÔÁ ×ÏÚÍÏÖÎÏÓÔØ ÐÒÅÄÏÓÔÁ×ÌÑÅÔÓÑ ÔÏÌØËÏ
	ÐÏÌÉÔÉËÏÊ <acronym>MAC</acronym> LOMAC policy.</para>
    </sect2>
  </sect1>

  <sect1 id="mac-implementing">
    <title>òÅÁÌÉÚÁÃÉÑ ÚÁÝÉÝÅÎÎÏÊ ÓÒÅÄÙ Ó MAC</title>

    <indexterm>
      <primary>MAC Example Implementation</primary>
    </indexterm>
    <indexterm>
      <primary>MAC -- ÐÒÉÍÅÒ ÒÅÁÌÉÚÁÃÉÉ</primary>
    </indexterm>

    <para>îÉÖÅÓÌÅÄÕÀÝÁÑ ÄÅÍÏÎÓÔÒÁÃÉÑ ÒÅÁÌÉÚÕÅÔ ÚÁÝÉÝÅÎÎÕÀ ÓÒÅÄÕ
      Ó ÉÓÐÏÌØÚÏ×ÁÎÉÅÍ ÒÁÚÌÉÞÎÙÈ <acronym>MAC</acronym> ÍÏÄÕÌÅÊ
      Ó ÓÏÏÔ×ÅÔÓÔ×ÅÎÎÏ ÎÁÓÔÒÏÅÎÎÙÍÉ ÐÏÌÉÔÉËÁÍÉ.  éÓÐÏÌØÚÕÊÔÅ
      ÜÔÏÔ ÐÒÉÍÅÒ ÔÏÌØËÏ ÄÌÑ ÔÅÓÔÉÒÏ×ÁÎÉÑ, ÏÎ ÎÅ ÐÒÅÄÎÁÚÎÁÞÅÎ
      ÄÌÑ ÕÄÏ×ÌÅÔ×ÏÒÅÎÉÑ ×ÓÅÈ ÔÒÅÂÏ×ÁÎÉÊ Ë ÚÁÝÉÔÅ.  òÅÁÌÉÚÁÃÉÑ
      ÜÔÉÈ ÐÏÌÉÔÉË ÂÅÚ ÐÏÎÉÍÁÎÉÑ ÐÒÉÎÃÉÐÁ ÉÈ ÒÁÂÏÔÙ ÎÅÐÒÉÍÅÎÉÍÁ
      × ÒÅÁÌØÎÙÈ ÚÁÄÁÞÁÈ.</para>

    <para>ðÅÒÅÄ ÎÁÞÁÌÏÍ ÐÒÏÃÅÓÓÁ ÎÁÓÔÒÏÊËÉ, ÎÁ ËÁÖÄÕÀ ÆÁÊÌÏ×ÕÀ
      ÓÉÓÔÅÍÕ ÎÅÏÂÈÏÄÉÍÏ ÕÓÔÁÎÏ×ÉÔØ ÐÁÒÁÍÅÔÒ <literal>multilabel</literal>,
      ËÏÔÏÒÙÊ ÕÐÏÍÉÎÁÌÓÑ × ÎÁÞÁÌÅ ÜÔÏÊ ÇÌÁ×Ù.  îÅ×ÙÐÏÌÎÅÎÉÅ
      ÜÔÏÇÏ ÔÒÅÂÏ×ÁÎÉÑ ÐÒÉ×ÅÄÅÔ Ë ÏÛÉÂËÁÍ.</para>

    <sect2>
      <title>óÏÚÄÁÎÉÅ insecure ËÌÁÓÓÁ ÐÏÌØÚÏ×ÁÔÅÌÑ</title>

      <para>îÁÞÎÉÔÅ ÐÒÏÃÅÄÕÒÕ ÄÏÂÁ×ÌÅÎÉÅÍ ÓÌÅÄÕÀÝÅÇÏ ËÌÁÓÓÁ
	ÐÏÌØÚÏ×ÁÔÅÌÑ Ë ÆÁÊÌÕ
	<filename>/etc/login.conf</filename>:</para>

      <programlisting>insecure:\
:copyright=/etc/COPYRIGHT:\
:welcome=/etc/motd:\
:setenv=MAIL=/var/mail/$,BLOCKSIZE=K:\
:path=~/bin:/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin
:manpath=/usr/share/man /usr/local/man:\
:nologin=/usr/sbin/nologin:\
:cputime=1h30m:\
:datasize=8M:\
:vmemoryuse=100M:\
:stacksize=2M:\
:memorylocked=4M:\
:memoryuse=8M:\
:filesize=8M:\
:coredumpsize=8M:\
:openfiles=24:\
:maxproc=32:\
:priority=0:\
:requirehome:\
:passwordtime=91d:\
:umask=022:\
:ignoretime@:\
:label=partition/13,mls/5:</programlisting>

      <para>É ÄÏÂÁ×ÌÅÎÉÅÍ ÓÌÅÄÕÀÝÅÊ ÓÔÒÏËÉ Ë default ËÌÁÓÓÕ
	ÐÏÌØÚÏ×ÁÔÅÌÑ:</para>

      <programlisting>:label=mls/equal,biba/equal,partition/equal:</programlisting>

      <para>ðÏÓÌÅ ÚÁ×ÅÒÛÅÎÉÑ ÜÔÉÈ ÄÅÊÓÔ×ÉÊ, ÄÌÑ ÐÅÒÅÓÂÏÒËÉ ÂÁÚÙ ÄÁÎÎÙÈ
	ÄÏÌÖÎÁ ÂÙÔØ ×ÙÐÏÌÎÅÎÁ ÓÌÅÄÕÀÝÁÑ ËÏÍÁÎÄÁ:</para>

      <screen>&prompt.root; <userinput>cap_mkdb /etc/login.conf</userinput></screen>
    </sect2>

    <sect2>
      <title>úÁÇÒÕÚËÁ Ó ÎÅÏÂÈÏÄÉÍÙÍÉ ÍÏÄÕÌÑÍÉ</title>

      <para>äÏÂÁ×ØÔÅ Ë
	<filename>/boot/loader.conf</filename> ÓÌÅÄÕÀÝÉÅ ÓÔÒÏËÉ,
	ÞÔÏÂÙ ÎÅÏÂÈÏÄÉÍÙÅ ÍÏÄÕÌÉ ÂÙÌÉ ÚÁÇÒÕÖÅÎÙ ÐÒÉ ÓÔÁÒÔÅ
	ÓÉÓÔÅÍÙ:</para>

      <programlisting>mac_biba_load="YES"
mac_mls_load="YES"
mac_seeotheruids_load="YES"
mac_partition_load="YES"</programlisting>
    </sect2>

    <sect2>
      <title>õÓÔÁÎÏ×ËÁ ×ÓÅÈ ÐÏÌØÚÏ×ÁÔÅÌÅÊ × insecure</title>

      <para>÷ÓÅÍ ÕÞÅÔÎÙÍ ÚÁÐÉÓÑÍ, ËÒÏÍÅ <username>root</username>
	ÉÌÉ ÓÉÓÔÅÍÎÙÈ ÐÏÌØÚÏ×ÁÔÅÌÅÊ ÔÅÐÅÒØ ÐÏÔÒÅÂÕÅÔÓÑ ÐÒÉÓ×ÏÉÔØ
	ËÌÁÓÓ (login class).  ðÒÉ ÏÔÓÕÔÓÔ×ÉÉ ËÌÁÓÓÁ ÐÏÌØÚÏ×ÁÔÅÌÉ
	ÎÅ ÓÍÏÇÕÔ ÐÏÌÕÞÉÔØ ÄÏÓÔÕÐÁ Ë ÏÂÙÞÎÙÍ ËÏÍÁÎÄÁÍ, ÔÁËÉÍ ËÁË
	&man.vi.1;.  óÌÅÄÕÀÝÉÊ ÓËÒÉÐÔ <command>sh</command>
	ÓÄÅÌÁÅÔ ×ÓÅ ÎÅÏÂÈÏÄÉÍÏÅ:</para>

      <screen>&prompt.root; <userinput>for x in `awk -F: '($3 >= 1001) && ($3 != 65534) { print $1 }' \</userinput>
	<userinput>/etc/passwd`; do pw usermod $x -L insecure; done;</userinput></screen>

      <para>ðÏÓÌÅ ÜÔÏÇÏ ÉÚÍÅÎÅÎÉÑ ÎÅÏÂÈÏÄÉÍÏ ÚÁÐÕÓÔÉÔØ ËÏÍÁÎÄÕ
	<command>cap_mkdb</command> ÎÁ ÆÁÊÌÅ
	<filename>/etc/master.passwd</filename>.</para>
    </sect2>

    <sect2>
      <title>úÁ×ÅÒÛÅÎÉÅ ÎÁÓÔÒÏÊËÉ</title>

      <para>äÏÌÖÅÎ ÂÙÔØ ÓÏÚÄÁÎ ÆÁÊÌ ËÏÎÔÅËÓÔÁ; ÓÌÅÄÕÀÝÉÊ ÐÒÉÍÅÒ
	×ÚÑÔ ÉÚ ÐÒÉÍÅÒÁ ÐÏÌÉÔÉËÉ ÏÔ Robert Watson, ÏÎ ÍÏÖÅÔ ÂÙÔØ
	ÐÏÍÅÝÅÎ × <filename>/etc/policy.contexts</filename>:</para>

      <programlisting># This is the default BIBA/MLS policy for this system.

.*                              biba/high,mls/high
/sbin/dhclient                  biba/high(low),mls/high(low)
/dev(/.*)?                      biba/equal,mls/equal
# This is not an exhaustive list of all "privileged" devices.
/dev/mdctl                      biba/high,mls/high
/dev/pci                        biba/high,mls/high
/dev/k?mem                      biba/high,mls/high
/dev/io                         biba/high,mls/high
/dev/agp.*                      biba/high,mls/high
(/var)?/tmp(/.*)?               biba/equal,mls/equal
/tmp/\.X11-unix                 biba/high(equal),mls/high(equal)
/tmp/\.X11-unix/.*              biba/equal,mls/equal
/proc(/.*)?                     biba/equal,mls/equal
/mnt.*                          biba/low,mls/low
(/usr)?/home                    biba/high(low),mls/high(low)
(/usr)?/home/.*                 biba/low,mls/low
/var/mail(/.*)?                 biba/low,mls/low
/var/spool/mqueue(/.*)?         biba/low,mls/low
(/mnt)?/cdrom(/.*)?             biba/high,mls/high
(/usr)?/home/(ftp|samba)(/.*)?  biba/high,mls/high
/var/log/sendmail\.st           biba/low,mls/low
/var/run/utmp                   biba/equal,mls/equal
/var/log/(lastlog|wtmp)         biba/equal,mls/equal</programlisting>

      <para>üÔÁ ÐÏÌÉÔÉËÁ ÏÂÅÓÐÅÞÉÔ ÂÅÚÏÐÁÓÎÏÓÔØ ÐÕÔÅÍ ÐÒÉÍÅÎÅÎÉÑ
	ÏÇÒÁÎÉÞÅÎÉÊ ÎÁ ÎÉÓÈÏÄÑÝÉÊ É ×ÏÓÈÏÄÑÝÉÊ ÐÏÔÏËÉ ÉÎÆÏÒÍÁÃÉÉ
	× ÐÒÉÍÅÎÅÎÉÉ Ë ËÁÔÁÌÏÇÁÍ É ÕÔÉÌÉÔÁÍ, ÐÒÉ×ÅÄÅÎÎÙÍ × ÌÅ×ÏÊ
	ÞÁÓÔÉ ÆÁÊÌÁ.</para>

      <para>ïÎ ÍÏÖÅÔ ÂÙÔØ ×ÎÅÓÅÎ × ÓÉÓÔÅÍÕ ÓÌÅÄÕÀÝÉÍÉ
	ËÏÍÁÎÄÁÍÉ:</para>

      <screen>&prompt.root; <userinput>setfsmac -ef /etc/policy.contexts /</userinput>
&prompt.root; <userinput>setfsmac -ef /etc/policy.contexts /usr</userinput></screen>

      <note>
	<para>òÁÓËÌÁÄËÁ ×ÙÛÅÐÒÉ×ÅÄÅÎÎÏÊ ÆÁÊÌÏ×ÏÊ ÓÉÓÔÅÍÙ ÍÏÖÅÔ ÂÙÔØ
	  ÒÁÚÌÉÞÎÏÊ ÄÌÑ ÒÁÚÎÙÈ ÓÉÓÔÅÍ.</para>
      </note>

      <para>æÁÊÌ <filename>/etc/mac.conf</filename> ÔÒÅÂÕÅÔ
	ÓÌÅÄÕÀÝÉÈ ÉÚÍÅÎÅÎÉÊ × ÏÓÎÏ×ÎÏÍ ÒÁÚÄÅÌÅ:</para>

      <programlisting>default_labels file ?biba,?mls
default_labels ifnet ?biba,?mls
default_labels process ?biba,?mls,?partition
default_labels socket ?biba,?mls</programlisting>
    </sect2>

    <sect2>
      <title>ôÅÓÔÉÒÏ×ÁÎÉÅ ÎÁÓÔÒÏÊËÉ</title>

      <indexterm>
	<primary>MAC Configuration Testing</primary>
      </indexterm>

      <para>äÏÂÁ×ØÔÅ ÐÏÌØÚÏ×ÁÔÅÌÑ Ó ÐÏÍÏÝØÀ ËÏÍÁÎÄÙ
	<command>adduser</command> É ÐÏÍÅÓÔÉÔÅ ÅÇÏ × ËÌÁÓÓ
	<literal>insecure</literal> ÄÌÑ ÜÔÉÈ ÔÅÓÔÏ×.</para>

      <para>÷ ÐÒÉÍÅÒÁÈ ÎÉÖÅ ÔÅÓÔÉÒÏ×ÁÎÉÅ <username>root</username>
	É ÏÂÙÞÎÙÈ ÐÏÌØÚÏ×ÁÔÅÌÅÊ ÂÕÄÅÔ ÓÍÅÛÉ×ÁÔØÓÑ; ÆÏÒÍÁ
	ÐÒÉÇÌÁÛÅÎÉÑ ÐÏÍÏÖÅÔ ÒÁÚÌÉÞÉÔØ ÜÔÉÈ ÐÏÌØÚÏ×ÁÔÅÌÅÊ.</para>

      <sect3>
	<title>ïÓÎÏ×ÎÏÅ ÔÅÓÔÉÒÏ×ÁÎÉÅ ÍÅÔÏË</title>

	<screen>&prompt.user; <userinput>getpmac</userinput>
biba/15(15-15),mls/15(15-15),partition/15
&prompt.root; <userinput>setpmac partition/15,mls/equal top</userinput></screen>

	<note>
	  <para>ðÒÏÃÅÓÓ top ÂÕÄÅÔ ÕÎÉÞÔÏÖÅÎ ÐÅÒÅÄ ÔÅÍ, ËÁË ÍÙ ÚÁÐÕÓÔÉÍ
	    ÄÒÕÇÏÊ ÐÒÏÃÅÓÓ top.</para>
	</note>
      </sect3>

      <sect3>
	<title>ôÅÓÔÉÒÏ×ÁÎÉÅ MAC seeotheruids</title>

	<screen>&prompt.user; <userinput>ps Zax</userinput>
biba/15(15-15),mls/15(15-15),partition/15  1096 #C:  S      0:00.03 -su (bash)
biba/15(15-15),mls/15(15-15),partition/15  1101 #C:  R+     0:00.01 ps Zax</screen>

	<para>ðÒÏÓÍÏÔÒ ÐÒÏÃÅÓÓÏ× ×ÓÅÈ ÄÒÕÇÉÈ ÐÏÌØÚÏ×ÁÔÅÌÅÊ ÄÏÌÖÅÎ
	  ÂÙÔØ ÚÁÐÒÅÝÅÎ.</para>
      </sect3>

      <sect3>
	<title>ôÅÓÔÉÒÏ×ÁÎÉÅ MAC partition</title>

	<para>ïÔËÌÀÞÉÔÅ ÐÏÌÉÔÉËÕ <acronym>MAC</acronym>
	  <literal>seeotheruids</literal> ÄÌÑ ÏÓÔÁÌØÎÙÈ ÔÅÓÔÏ×:</para>

	<screen>&prompt.root; <userinput>sysctl security.mac.seeotheruids.enabled=0</userinput>
&prompt.user; <userinput>ps Zax</userinput>
LABEL                                                   PID  TT  STAT      TIME COMMAND
  biba/equal(low-high),mls/equal(low-high),partition/15  1122 #C:  S+     0:00.02 top
  biba/15(15-15),mls/15(15-15),partition/15              1096 #C:  S      0:00.05 -su (bash)
  biba/15(15-15),mls/15(15-15),partition/15              1123 #C:  R+     0:00.01 ps Zax</screen>

	<para>÷ÓÅ ÐÏÌØÚÏ×ÁÔÅÌÉ ÄÏÌÖÎÙ ×ÉÄÅÔØ ËÁÖÄÙÊ ÐÒÏÃÅÓÓ × Ó×ÏÅÍ
	  ÒÁÚÄÅÌÅ (partition).</para>
      </sect3>

      <sect3>
	<title>ôÅÓÔÉÒÏ×ÁÎÉÅ ÍÅÔÏË Biba É MLS</title>

	<screen>&prompt.root; <userinput>setpmac partition/15,mls/equal,biba/high\(high-high\) top</userinput>
&prompt.user; <userinput>ps Zax</userinput>
LABEL                                                   PID  TT  STAT    TIME   COMMAND
  biba/high(high-high),mls/equal(low-high),partition/15   1251 #C:  S+     0:00.02 top
  biba/15(15-15),mls/15(15-15),partition/15               1096 #C:  S      0:00.06 -su (bash)
  biba/15(15-15),mls/15(15-15),partition/15               1157 #C:  R+     0:00.00 ps Zax</screen>

	<para>ðÏÌÉÔÉËÁ Biba ÐÏÚ×ÏÌÑÅÔ ÞÔÅÎÉÅ ÏÂßÅËÔÏ× Ó ÂÏÌÅÅ ×ÙÓÏËÉÍÉ
	  ÍÅÔËÁÍÉ.</para>

	<screen>&prompt.root; <userinput>setpmac partition/15,mls/equal,biba/low top</userinput>
&prompt.user; <userinput>ps Zax</userinput>
LABEL                                       PID  TT  STAT      TIME COMMAND
  biba/15(15-15),mls/15(15-15),partition/15  1096 #C:  S      0:00.07 -su (bash)
  biba/15(15-15),mls/15(15-15),partition/15  1226 #C:  R+     0:00.01 ps Zax</screen>

	<para>ðÏÌÉÔÉËÁ Biba ÎÅ ÐÏÚ×ÏÌÑÅÔ ÞÔÅÎÉÅ ÏÂßÅËÔÏ× Ó ÂÏÌÅÅ ÎÉÚËÉÍÉ
	  ÍÅÔËÁÍÉ; ÔÅÍ ÎÅ ÍÅÎÅÅ, <acronym>MLS</acronym> ÒÁÚÒÅÛÁÅÔ ÜÔÏ.</para>

	<screen>&prompt.user; <userinput>ifconfig bge0 | grep maclabel</userinput>
maclabel biba/low(low-low),mls/low(low-low)
&prompt.user; <userinput>ping -c 1 192.0.34.166</userinput>
PING 192.0.34.166 (192.0.34.166): 56 data bytes
ping: sendto: Permission denied</screen>

	<para>ðÏÌØÚÏ×ÁÔÅÌÉ ÎÅ ÍÏÇÕÔ ×ÙÐÏÌÎÉÔØ ping ÎÁ
	  <hostid role="domainname">example.com</hostid>, ÉÌÉ ÎÁ ÌÀÂÏÊ
	  ÄÏÍÅÎ ÐÏ ÜÔÏÊ ÐÒÉÞÉÎÅ.</para>

	<para>äÌÑ ÕÓÔÒÁÎÅÎÉÑ ÜÔÏÊ ÏÛÉÂËÉ, ÚÁÐÕÓÔÉÔÅ ÓÌÅÄÕÀÝÕÀ
	  ËÏÍÁÎÄÕ:</para>

	<screen>&prompt.root; <userinput>sysctl security.mac.biba.trust_all_interfaces=1</userinput></screen>

	<para>ïÎÁ ÕÓÔÁÎÁ×ÌÉ×ÁÅÔ ÍÅÔËÕ ÉÎÔÅÒÆÅÊÓÁ ÐÏ ÕÍÏÌÞÁÎÉÀ ×
	  ÎÅÚÁÝÉÝÅÎÎÙÊ ÒÅÖÉÍ, ÔÁË ÞÔÏ ÐÏÌÉÔÉËÁ Biba ÐÏ ÕÍÏÌÞÁÎÉÀ ÎÅ
	  ÂÕÄÅÔ ÐÒÉÍÅÎÅÎÁ.</para>

	<screen>&prompt.root; <userinput>ifconfig bge0 maclabel biba/equal\(low-high\),mls/equal\(low-high\)</userinput>
&prompt.user; <userinput>ping -c 1 192.0.34.166</userinput>
PING 192.0.34.166 (192.0.34.166): 56 data bytes
64 bytes from 192.0.34.166: icmp_seq=0 ttl=50 time=204.455 ms
--- 192.0.34.166 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max/stddev = 204.455/204.455/204.455/0.000 ms</screen>

	<para>õÓÔÁÎÏ×É× ÂÏÌÅÅ ËÏÒÒÅËÔÎÕÀ ÍÅÔËÕ, ÍÙ ÍÏÖÅÍ ÉÓÐÏÌØÚÏ×ÁÔØ
	  <command>ping</command>.</para>

	<para>ôÅÐÅÒØ ÓÏÚÄÁÄÉÍ ÆÁÊÌÙ ÄÌÑ ÐÒÏÃÅÄÕÒÙ ÔÅÓÔÉÒÏ×ÁÎÉÑ ÞÔÅÎÉÑ
	  É ÚÁÐÉÓÉ:</para>

	<screen>&prompt.root; <userinput>touch test1 test2 test3 test4 test5</userinput>
&prompt.root; <userinput>getfmac test1</userinput>
test1: biba/equal,mls/equal
&prompt.root; <userinput>setfmac biba/low test1 test2; setfmac biba/high test4 test5; \
  setfmac mls/low test1 test3; setfmac mls/high test2 test4</userinput>
&prompt.root; <userinput>setfmac mls/equal,biba/equal test3 && getfmac test?</userinput>
test1: biba/low,mls/low
test2: biba/low,mls/high
test3: biba/equal,mls/equal
test4: biba/high,mls/high
test5: biba/high,mls/equal
&prompt.root; <userinput>chown testuser:testuser test?</userinput></screen>

	<para>÷ÓÅ ÜÔÉ ÆÁÊÌÙ ÄÏÌÖÎÙ ÐÒÉÎÁÄÌÅÖÁÔØ ÐÏÌØÚÏ×ÁÔÅÌÀ
	  <username>testuser</username>.  ôÅÓÔÙ ÎÁ ÞÔÅÎÉÅ:</para>

	<screen>&prompt.user; <userinput>ls</userinput>
test1   test2   test3   test4   test5
&prompt.user; <userinput>ls test?</userinput>
ls: test1: Permission denied
ls: test2: Permission denied
ls: test4: Permission denied
test3   test5</screen>

	<para>äÏÓÔÕÐ ÎÁ ÞÔÅÎÉÅ ÎÅ ÄÏÌÖÅÎ ÂÙÔØ ÒÁÚÒÅÛÅÎ ÄÌÑ ÐÁÒ:
	  <literal>(biba/low,mls/low)</literal>,
	  <literal>(biba/low,mls/high)</literal> É
	  <literal>(biba/high,mls/high)</literal>.
	  ôÅÐÅÒØ ÎÅÓËÏÌØËÏ ÔÅÓÔÏ× ÎÁ ÚÁÐÉÓØ:</para>

	<screen>&prompt.user; <userinput>for i in `echo test*`; do echo 1 > $i; done</userinput>
-su: test1: Permission denied
-su: test4: Permission denied
-su: test5: Permission denied</screen>

	<para>ðÏÄÏÂÎÏ ÔÅÓÔÁÍ ÎÁ ÞÔÅÎÉÅ, ÄÏÓÔÕÐ ÎÁ ÚÁÐÉÓØ ÄÏÌÖÅÎ ÂÙÔØ
	  ÚÁÐÒÅÝÅÎ ÄÌÑ ÐÁÒ:
	  <literal>(biba/low,mls/high)</literal> É
	  <literal>(biba/equal,mls/equal)</literal>.</para>

	<screen>&prompt.user; <userinput>cat test?</userinput>
cat: test1: Permission denied
cat: test2: Permission denied
1
cat: test4: Permission denied</screen>

	<para>á ÔÅÐÅÒØ ÏÔ <username>root</username>:</para>

	<screen>&prompt.root; <userinput>cat test2</userinput>
1</screen>
      </sect3>
    </sect2>
  </sect1>

  <sect1 id="MAC-examplehttpd">
    <title>äÒÕÇÏÊ ÐÒÉÍÅÒ: éÓÐÏÌØÚÏ×ÁÎÉÅ MAC ÄÌÑ ÚÁÝÉÔÙ ×Å ÓÅÒ×ÅÒÁ</title>

      <para>âÕÄÅÔ ÓÏÚÄÁÎÏ ÏÔÄÅÌØÎÏÅ ÈÒÁÎÉÌÉÝÅ ÄÌÑ ×Å ÄÁÎÎÙÈ,
	Ë ËÏÔÏÒÏÍÕ ÐÏÌØÚÏ×ÁÔÅÌÉ ÄÏÌÖÎÙ ÉÍÅÔØ ÄÏÓÔÕÐ.  üÔÏ ÐÏÚ×ÏÌÉÔ
	<literal>biba/high</literal> ÕÐÒÁ×ÌÑÔØ ÄÏÓÔÕÐÏÍ Ë ×ÅÂ
	ÄÁÎÎÙÍ.</para>

      <para>îÁÞÎÉÔÅ Ó ÓÏÚÄÁÎÉÑ ËÁÔÁÌÏÇÁ ÄÌÑ ÈÒÁÎÅÎÉÑ ×ÅÂ
	ÄÁÎÎÙÈ:</para>

      <screen>&prompt.root; <userinput>mkdir /usr/home/cvs</userinput></screen>

      <para>ôÅÐÅÒØ ÉÎÉÃÉÁÌÉÚÉÒÕÊÔÅ ÅÇÏ ËÏÍÁÎÄÏÊ
	<command>cvs</command>:</para>

      <screen>&prompt.root; <userinput>cvs -d /usr/home/cvs init</userinput></screen>

      <para>äÌÑ ÎÁÞÁÌÁ ÎÅÏÂÈÏÄÉÍÏ ×ËÌÀÞÉÔØ ÐÏÌÉÔÉËÕ <literal>biba</literal>,
	ÄÏÂÁ×É×  <literal>mac_biba_enable="YES"</literal> ×
	<filename>/boot/loader.conf</filename>.  ðÒÅÄÐÏÌÁÇÁÅÔÓÑ, ÞÔÏ
	ÑÄÒÏ ÓËÏÍÐÉÌÉÒÏ×ÁÎÏ Ó ÐÏÄÄÅÒÖËÏÊ <acronym>MAC</acronym>.</para>

      <para>äÁÌÅÅ ÕÓÔÁÎÏ×ÉÔÅ ÍÅÔËÕ <literal>biba/high</literal> ÄÌÑ ×ÓÅÊ
	ÓÉÓÔÅÍÙ ÐÏ ÕÍÏÌÞÁÎÉÀ.</para>

      <para>÷ ÆÁÊÌ <filename>login.conf</filename>, ËÌÁÓÓ default,
	ÎÅÏÂÈÏÄÉÍÏ ×ÎÅÓÔÉ ÓÌÅÄÕÀÝÉÅ ÉÚÍÅÎÅÎÉÑ:</para>

      <programlisting>:ignoretime@:\
	:umask=022:\
	:label=biba/high:</programlisting>

      <para>ëÁÖÄÏÇÏ ÐÏÌØÚÏ×ÁÔÅÌÑ ÎÅÏÂÈÏÄÉÍÏ ÐÏÍÅÓÔÉÔØ × ËÌÁÓÓ ÐÏ
	ÕÍÏÌÞÁÎÉÀ; ÔÁËÁÑ ËÏÍÁÎÄÁ:</para>

      <screen>&prompt.root; <userinput>for x in `awk -F: '($3 >= 1001) && ($3 != 65534) { print $1 }' \</userinput>
	<userinput>/etc/passwd`; do pw usermod $x -L default; done;</userinput></screen>

      <para>ÂÙÓÔÒÏ ÒÅÛÉÔ ÜÔÕ ÚÁÄÁÞÕ.</para>

      <para>ôÅÐÅÒØ ÓÏÚÄÁÄÉÍ ÄÒÕÇÏÊ ËÌÁÓÓ, web, ËÏÐÉÀ ËÌÁÓÓÁ default
	Ó ÍÅÔËÏÊ, ÕÓÔÁÎÏ×ÌÅÎÎÏÊ × <literal>biba/low</literal>.</para>

      <para>óÏÚÄÁÊÔÅ ÐÏÌØÚÏ×ÁÔÅÌÑ ÄÌÑ ÒÁÂÏÔÙ Ó ÏÓÎÏ×ÎÙÍÉ ×Å ÄÁÎÎÙÍÉ,
	ÈÒÁÎÑÝÉÍÉÓÑ × ÒÅÐÏÚÉÔÏÒÉÉ <application>cvs</application>.
	üÔÏÇÏ ÐÏÌØÚÏ×ÁÔÅÌÑ ÎÅÏÂÈÏÄÉÍÏ ÐÏÍÅÓÔÉÔØ × ÎÏ×ÙÊ ËÌÁÓÓ,
	<username>web</username>.</para>

      <para>ðÏÓËÏÌØËÕ ÍÅÔËÁ ÐÏ ÕÍÏÌÞÁÎÉÀ <literal>biba/high</literal>,
	ÎÁ ÒÅÐÏÚÉÔÏÒÉÉ ÏÎÁ ÂÕÄÅÔ ÔÏÊ ÖÅ.  ÷Å ÄÁÎÎÙÅ ÄÏÌÖÎÙ ÉÍÅÔØ
	ÔÕ ÖÅ ÍÅÔËÕ, ÞÔÏÂÙ Õ ÐÏÌØÚÏ×ÁÔÅÌÅÊ ÂÙÌ ÄÏÓÔÕÐ Ë ÎÉÍ ÎÁ
	ÞÔÅÎÉÅ/ÚÁÐÉÓØ.  ÷Å ÓÅÒ×ÅÒ ÄÏÌÖÅÎ ÉÍÅÔØ ÄÏÓÔÕÐ Ë ÔÅÍ ÖÅ
	ÄÁÎÎÙÍ, Ë ËÏÔÏÒÙÍ ÅÓÔØ ÄÏÓÔÕÐ Õ ÐÏÌØÚÏ×ÁÔÅÌÅÊ Ó ÍÅÔËÏÊ
	<literal>biba/high</literal>, ÄÌÑ ÜÔÏÇÏ ÎÅÏÂÈÏÄÉÍÏ ÐÏÎÉÚÉÔØ
	ÍÅÔËÕ ÄÁÎÎÙÈ.</para>

      <para>÷ÓÅ, ÞÔÏ ÐÏÔÒÅÂÕÅÔÓÑ, ÜÔÏ ÓÌÅÄÕÀÝÉÊ &man.sh.1; ÓËÒÉÐÔ,
	ËÏÔÏÒÙÊ ÍÏÖÅÔ ÂÙÔØ ÚÁÐÕÝÅÎ ÉÚ &man.cron.8;:</para>

      <programlisting>PATH=/bin:/usr/bin:/usr/local/bin; export PATH;
CVSROOT=/home/repo; export CVSROOT;
cd /home/web;
cvs -qR checkout -P htdocs;
exit;</programlisting>

      <note>
	<para>÷Ï ÍÎÏÇÉÈ ÓÌÕÞÁÑÈ × ×Å ÆÁÊÌÙ <command>cvs</command>
	  ÎÅÏÂÈÏÄÉÍÏ ÐÏÍÅÓÔÉÔØ ÔÅÇÉ Id.</para>
      </note>

      <para>üÔÏÔ ÓËÒÉÐÔ ÔÅÐÅÒØ ÍÏÖÅÔ ÂÙÔØ ÐÏÍÅÝÅÎ × ÄÏÍÁÛÎÉÊ ËÁÔÁÌÏÇ
	ËÁÔÁÌÏÇ ÐÏÌØÚÏ×ÁÔÅÌÑ <username>web</username>,  ÎÅÏÂÈÏÄÉÍÏ
	ÔÁËÖÅ ÄÏÂÁ×ÉÔØ ÓÌÅÄÕÀÝÕÀ ÚÁÐÉÓØ &man.crontab.1;:</para>

      <programlisting># ÷ÙÐÏÌÎÑÔØ checkout web ÄÁÎÎÙÈ ÐÏÄ ÍÅÔËÏÊ biba/low ËÁÖÄÙÅ 12 ÞÁÓÏ×:
0       */12       *       *       *       web    /home/web/checkout.sh</programlisting>

      <para>üÔÁ ÚÁÐÉÓØ ÂÕÄÅÔ ÉÚ×ÌÅËÁÔØ <acronym>HTML</acronym> ÓÔÒÁÎÉÃÙ
	ËÁÖÄÙÅ Ä×ÅÎÁÄÃÁÔØ ÞÁÓÏ×.</para>

      <para>íÅÔÏÄ ÚÁÐÕÓËÁ ×Å ÓÅÒ×ÅÒÁ ÐÏ ÕÍÏÌÞÁÎÉÀ ÔÁËÖÅ ÄÏÌÖÅÎ ÂÙÔØ
	ÉÚÍÅÎÅÎ ÄÌÑ ÚÁÐÕÓËÁ ÐÒÏÃÅÓÓÁ Ó ÍÅÔËÏÊ <literal>biba/low</literal>.
	üÔÏ ÍÏÖÅÔ ÂÙÔØ ÓÄÅÌÁÎÏ ÐÕÔÅÍ ÓÌÅÄÕÀÝÅÇÏ ÉÚÍÅÎÅÎÉÑ × ÓËÒÉÐÔÅ
	<filename>/usr/local/etc/rc.d/apache.sh</filename>:</para>

      <programlisting>command="setpmac biba/low /usr/local/sbin/httpd"</programlisting>

      <para>îÁÓÔÒÏÊËÉ <application>Apache</application> ÄÏÌÖÎÙ ÂÙÔØ ÉÚÍÅÎÅÎÙ
	ÄÌÑ ÒÁÂÏÔÙ Ó ÐÏÌÉÔÉËÏÊ <literal>biba/low</literal>.  ÷ ÜÔÏÍ
	ÓÌÕÞÁÅ ÎÅÏÂÈÏÄÉÍÏ ÕËÁÚÁÔØ ÄÌÑ ÈÒÁÎÅÎÉÑ ÌÏÇ ÆÁÊÌÏ× ËÁÔÁÌÏÇ Ó
	ÍÅÔËÏÊ <literal>biba/low</literal>, ÉÎÁÞÅ ÂÕÄÕÔ ×ÏÚ×ÒÁÝÅÎÙ
	ÏÛÉÂËÉ <errorname>access denied</errorname>.</para>

      <note>
	<para>÷ ÜÔÏÍ ÐÒÉÍÅÒÅ ÎÅÏÂÈÏÄÉÍÏ ÕËÁÚÁÔØ × ÄÉÒÅËÔÉ×Å
	  <literal>docroot</literal> ËÁÔÁÌÏÇ
	  <filename>/home/web/htdocs</filename>; ÉÌÉ,
	  <application>Apache</application> ÎÅ ÓÍÏÖÅÔ
	  ÎÁÊÔÉ ËÁÔÁÌÏÇ Ó ÄÏËÕÍÅÎÔÁÍÉ.</para>
      </note>

      <para>îÅÏÂÈÏÄÉÍÏ ÔÁËÖÅ ÉÚÍÅÎÉÔØ ÄÒÕÇÉÅ ÐÁÒÁÍÅÔÒÙ ËÏÎÆÉÇÕÒÁÃÉÉ,
	×ËÌÀÞÁÑ <acronym>PID</acronym> ÆÁÊÌ,
	<literal>Scoreboardfile</literal>,
	<literal>DocumentRoot</literal>, ÉÌÉ ÌÀÂÙÅ ÄÒÕÇÉÅ
	ÎÁÓÔÒÏÊËÉ ÄÌÑ ËÁÔÁÌÏÇÏ×, ÇÄÅ ÎÅÏÂÈÏÄÉÍ ÄÏÓÔÕÐ ÎÁ ÚÁÐÉÓØ.
	ðÒÉ ÉÓÐÏÌØÚÏ×ÁÎÉÉ <literal>biba</literal> ÂÕÄÅÔ ÚÁÐÒÅÝÅÎ
	ÄÏÓÔÕÐ ÎÁ ÚÁÐÉÓØ ×Ï ×ÓÅ ËÁÔÁÌÏÇÉ ÓÅÒ×ÅÒÁ, ÎÁ ËÏÔÏÒÙÈ
	ÎÅÔ ÍÅÔËÉ <literal>biba/low</literal>.</para>

<!--
PROBLEM: CAN THIS WORK?  OR SHOULD IT BE start_precmd?  More testing need here.
-->
  </sect1>

<!--
XXX

   <sect1 id="mac-examplesandbox">
     <title>An Example of a MAC Sandbox</title>
 
     <para>An example of placing users in a sandbox using
       <acronym>MAC</acronym> should go here.</para>
   </sect1>
-->

  <sect1 id="mac-troubleshoot">
    <title>òÅÛÅÎÉÅ ÐÒÏÂÌÅÍ Ó ÉÎÆÒÁÓÔÒÕËÔÕÒÏÊ MAC</title>

    <indexterm>
      <primary>MAC Troubleshooting</primary>
    </indexterm>

    <para>îÁ ÓÔÁÄÉÉ ÒÁÚÒÁÂÏÔËÉ ÎÅÓËÏÌØËÏ ÐÏÌØÚÏ×ÁÔÅÌÅÊ ÓÏÏÂÝÁÌÉ
      Ï ÐÒÏÂÌÅÍÁÈ ÐÒÉ ÏÂÙÞÎÙÈ ÎÁÓÔÒÏÊËÁÈ.  îÅËÏÔÏÒÙÅ ÉÚ ÜÔÉÈ
      ÐÒÏÂÌÅÍ ÐÒÉ×ÅÄÅÎÙ ÎÉÖÅ:</para>

    <sect2>
      <title>ðÁÒÁÍÅÔÒ <option>multilabel</option> ÎÅ ÍÏÖÅÔ ÂÙÔØ ×ËÌÀÞÅÎ ÎÁ
	<filename>/</filename></title>

      <para>ðÁÒÁÍÅÔÒ <option>multilabel</option> ÎÅ ×ËÌÀÞÁÅÔÓÑ ÎÁ
	ÍÏÅÍ ËÏÒÎÅ×ÏÍ (<filename>/</filename>) ÒÁÚÄÅÌÅ!</para>

      <para>ðÏÈÏÖÅ, ÞÔÏ ËÁÖÄÙÊ ÐÑÔÉÄÅÓÑÔÙÊ ÐÏÌØÚÏ×ÁÔÅÌØ ÓÔÁÌËÉ×ÁÅÔÓÑ
	Ó ÜÔÏÊ ÐÒÏÂÌÅÍÏÊ; ÎÁ ÓÁÍÏÍ ÄÅÌÅ, É Õ ÎÁÓ ÂÙÌÁ ÜÔÁ ÐÒÏÂÌÅÍÁ
	× ÐÅÒ×ÙÈ ÎÁÓÔÒÏÊËÁÈ.  äÁÌØÎÅÊÛÉÅ ÎÁÂÌÀÄÅÎÉÑ ÚÁ ÜÔÏÊ ÔÁË
	ÎÁÚÙ×ÁÅÍÏÊ <quote>ÏÛÉÂËÏÊ</quote> ÐÒÉ×ÅÌÉ ÍÅÎÑ Ë ÍÎÅÎÉÀ,
	ÞÔÏ ÜÔÏ ÒÅÚÕÌØÔÁÔ ÉÌÉ ÎÅËÏÒÒÅËÔÎÏÊ ÄÏËÕÍÅÎÔÁÃÉÉ, ÉÌÉ
	ÎÅÐÒÁ×ÉÌØÎÏÊ ÉÎÔÅÒÐÒÅÔÁÃÉÉ ÜÔÏÊ ÄÏËÕÍÅÎÔÁÃÉÉ.
	îÅÚÁ×ÉÓÉÍÏ ÏÔ ÔÏÇÏ, ÐÏÞÅÍÕ ÜÔÏ ÓÌÕÞÉÌÏÓØ, ÄÌÑ ÒÅÛÅÎÉÑ ÜÔÏÊ
	ÐÒÏÂÌÅÍÙ ÍÏÇÕÔ ÂÙÔØ ÐÒÅÄÐÒÉÎÑÔÙ ÓÌÅÄÕÀÝÉÅ ÛÁÇÉ:</para>

      <procedure>
	<step>
	  <para>ïÔÒÅÄÁËÔÉÒÕÊÔÅ <filename>/etc/fstab</filename> É ÕÓÔÁÎÏ×ÉÔÅ
	    ÄÌÑ ËÏÒÎÅ×ÏÇÏ ÒÁÚÄÅÌÁ ÐÁÒÁÍÅÔÒ ÔÏÌØËÏ ÄÌÑ ÞÔÅÎÉÑ
	    (<option>ro</option>).</para>
	</step>

	<step>
	  <para>ðÅÒÅÇÒÕÚÉÔÅÓØ × ÏÄÎÏÐÏÌØÚÏ×ÁÔÅÌØÓËÉÊ ÒÅÖÉÍ.</para>
	</step>

	<step>
	  <para>úÁÐÕÓÔÉÔÅ ËÏÍÁÎÄÕ <command>tunefs</command>
	    <option>-l enable</option> ÎÁ <filename>/</filename>.</para>
	</step>

	<step>
	  <para>ðÅÒÅÇÒÕÚÉÔÅ ÓÉÓÔÅÍÕ × ÎÏÒÍÁÌØÎÙÊ ÒÅÖÉÍ.</para>
	</step>

	<step>
	  <para>úÁÐÕÓÔÉÔÅ <command>mount</command> <option>-urw</option>
	  <filename>/</filename> É ÉÚÍÅÎÉÔÅ ÐÁÒÁÍÅÔÒ <option>ro</option>
	  ÏÂÒÁÔÎÏ ÎÁ <option>rw</option> × <filename>/etc/fstab</filename>;
	  ÐÅÒÅÇÒÕÚÉÔÅ ÓÉÓÔÅÍÕ ÏÐÑÔØ.</para>
	</step>

	<step>
	  <para>ä×ÁÖÄÙ ÐÒÏ×ÅÒØÔÅ ×Ù×ÏÄ
	  <command>mount</command>, ÞÔÏÂÙ ÕÂÅÄÉÔØÓÑ, ÞÔÏ ÐÁÒÁÍÅÔÒ
	  <option>multilabel</option> ÂÙÌ ÕÓÔÁÎÏ×ÌÅÎ ÎÁ ËÏÒÎÅ×ÏÊ
	  ÆÁÊÌÏ×ÏÊ ÓÉÓÔÅÍÅ.</para>
	</step>
     </procedure>
    </sect2>

    <sect2>
      <title>îÅ ÍÏÇÕ ÚÁÐÕÓÔÉÔØ &xfree86; ÐÏÓÌÅ <acronym>MAC</acronym></title>

      <para>ðÏÓÌÅ ÎÁÓÔÒÏÊËÉ ÓÉÓÔÅÍÙ ÂÅÚÏÐÁÓÎÏÓÔÉ
	<acronym>MAC</acronym>, Ñ ÂÏÌØÛÅ ÎÅ ÍÏÇÕ ÚÁÐÕÓËÁÔØ
	&xfree86;!</para>

      <para>üÔÏ ÍÏÖÅÔ ÂÙÔØ ×ÙÚ×ÁÎÏ ÐÏÌÉÔÉËÏÊ <acronym>MAC</acronym>
	<literal>partition</literal> ÉÌÉ ÐÕÔÅÍ ÎÅÐÒÁ×ÉÌØÎÏÊ ÕÓÔÁÎÏ×ËÉ
	ÍÅÔÏË ÏÄÎÏÊ ÉÚ ÐÏÌÉÔÉË <acronym>MAC</acronym>.  äÌÑ ÏÔÌÁÄËÉ
	ÐÏÐÒÏÂÕÊÔÅ ÓÌÅÄÕÀÝÅÅ:</para>

      <procedure>
	<step>
	  <para>ðÒÏÓÍÏÔÒÉÔÅ ÓÏÏÂÝÅÎÉÅ Ï ÏÛÉÂËÅ; ÅÓÌÉ ÐÏÌØÚÏ×ÁÔÅÌØ
	    ÎÁÈÏÄÉÔÓÑ × ËÌÁÓÓÅ <literal>insecure</literal>, ÐÒÏÂÌÅÍÁ
	    ÍÏÖÅÔ ÂÙÔØ × ÐÏÌÉÔÉËÅ <literal>partition</literal>.
	    ðÏÐÒÏÂÕÊÔÅ ÕÓÔÁÎÏ×ÉÔØ ËÌÁÓÓ ÐÏÌØÚÏ×ÁÔÅÌÑ ÏÂÒÁÔÎÏ ×
	    <literal>default</literal> É ÐÅÒÅÓÏÂÒÁÔØ ÂÁÚÕ ÄÁÎÎÙÈ
	    ËÏÍÁÎÄÏÊ <command>cap_mkdb</command>.  åÓÌÉ ÜÔÏ ÎÅ
	    ÒÅÛÉÔ ÐÒÏÂÌÅÍÙ, ÐÏÐÒÏÂÕÊÔÅ ÛÁÇ Ä×Á.</para>
	</step>

	<step>
	  <para>ä×ÁÖÄÙ ÐÒÏ×ÅÒØÔÅ ÐÏÌÉÔÉËÉ Ó ÍÅÔËÁÍÉ.  õÂÅÄÉÔÅÓØ, ÞÔÏ
	    ÐÏÌÉÔÉËÉ ÎÁÓÔÒÏÅÎÙ ÐÒÁ×ÉÌØÎÏ ÄÌÑ ÒÁÓÓÍÁÔÒÉ×ÁÅÍÏÇÏ ÐÏÌØÚÏ×ÁÔÅÌÑ,
	    ÐÒÉÌÏÖÅÎÉÑ &xfree86;, É ÕÓÔÒÏÊÓÔ× × <filename
	    class="directory">/dev</filename>.</para>
	</step>

	<step>
	  <para>åÓÌÉ ÐÒÏÂÌÅÍÁ ÎÅ ÒÅÛÅÎÁ, ÏÔÐÒÁ×ØÔÅ ÓÏÏÂÝÅÎÉÅ Ï ÏÛÉÂËÅ É
	    ÏÐÉÓÁÎÉÅ ×ÁÛÅÊ ÓÉÓÔÅÍÙ × ÓÐÉÓÏË ÒÁÓÓÙÌËÉ TrustedBSD,
	    ÎÁÈÏÄÑÝÉÊÓÑ ÎÁ ×Å ÓÁÊÔÅ
	    <ulink url="http://www.TrustedBSD.org">TrustedBSD</ulink>
	    ÉÌÉ × &a.questions;.</para>
	</step>
      </procedure>
    </sect2>

    <sect2>
      <title>Error: &man..secure.path.3; cannot stat <filename>.login_conf</filename></title>

      <para>ðÒÉ ÐÏÐÙÔËÅ ÐÅÒÅËÌÀÞÅÎÉÑ ÏÔ <username>root</username> ÎÁ ÄÒÕÇÏÇÏ
	ÐÏÌØÚÏ×ÁÔÅÌÑ ÓÉÓÔÅÍÙ, ÐÏÑ×ÌÑÅÔÓÑ ÓÏÏÂÝÅÎÉÅ Ï ÏÛÉÂËÅ
	<errorname>_secure_path: unable to state .login_conf</errorname>.</para>

      <para>üÔÏ ÓÏÏÂÝÅÎÉÅ ÏÂÙÞÎÏ ÐÏËÁÚÙ×ÁÅÔÓÑ, ËÏÇÄÁ Õ ÐÏÌØÚÏ×ÁÔÅÌÑ ÂÏÌÅÅ
	×ÙÓÏËÁÑ ÍÅÔËÁ, ÞÅÍ Õ ÐÏÌØÚÏ×ÁÔÅÌÑ, ËÏÔÏÒÙÍ ÏÎ ÐÙÔÁÅÔÓÑ ÓÔÁÔØ.
	îÁÐÒÉÍÅÒ, Õ ÐÏÌØÚÏ×ÁÔÅÌÑ ÓÉÓÔÅÍÙ <username>joe</username> ÍÅÔËÁ ÐÏ
	ÕÍÏÌÞÁÎÉÀ <option>biba/low</option>.  ðÏÌØÚÏ×ÁÔÅÌØ
	<username>root</username>, ÍÅÔËÁ ËÏÔÏÒÏÇÏ <option>biba/high</option>,
	ÎÅ ÍÏÖÅÔ ÐÒÏÓÍÁÔÒÉ×ÁÔØ ÄÏÍÁÛÎÉÊ ËÁÔÁÌÏÇ ÐÏÌØÚÏ×ÁÔÅÌÑ
	<username>joe</username>.  üÔÏ ÎÅ ÚÁ×ÉÓÉÔ ÏÔ ÔÏÇÏ, ÉÓÐÏÌØÚÕÅÔ ÌÉ
	ÐÏÌØÚÏ×ÁÔÅÌØ <username>root</username> ËÏÍÁÎÄÕ <command>su</command>
	<username>joe</username> ÉÌÉ ÎÅÔ.  ÷ ÜÔÏÍ ÓÃÅÎÁÒÉÉ ÍÏÄÅÌØ
	ÃÅÌÏÓÔÎÏÓÔÉ Biba ÎÅ ÐÏÚ×ÏÌÉÔ <username>root</username> ÐÒÏÓÍÁÔÒÉ×ÁÔØ
	ÏÂßÅËÔÙ Ó ÎÉÚËÉÍ ÕÒÏ×ÎÅÍ ÃÅÌÏÓÔÎÏÓÔÉ.</para>
    </sect2>

    <sect2>
      <title>ðÏÌØÚÏ×ÁÔÅÌÑ <username>root</username> ÎÅÔ!</title>

      <para>÷ ÎÏÒÍÁÌØÎÏÍ ÉÌÉ ÄÁÖÅ ÏÄÎÏÐÏÌØÚÏ×ÁÔÅÌØÓËÏÍ ÒÅÖÉÍÅ
	<username>root</username> ÎÅ ÏÂÎÁÒÕÖÉ×ÁÅÔÓÑ.  ëÏÍÁÎÄÁ
	<command>whoami</command> ×ÏÚ×ÒÁÝÁÅÔ 0 (ÎÕÌØ) É
	<command>su</command> ×ÏÚ×ÒÁÝÁÅÔ <errorname>who are you?</errorname>.
	þÔÏ ÍÏÖÎÏ ÓÄÅÌÁÔØ?</para>

      <para>üÔÏ ÍÏÖÅÔ ÐÒÏÉÚÏÊÔÉ, ÅÓÌÉ ÐÏÌÉÔÉËÁ Ó ÍÅÔËÁÍÉ ÂÙÌÁ ÏÔËÌÀÞÅÎÁ,
	ÉÌÉ ÞÅÒÅÚ &man.sysctl.8;, ÉÌÉ ÐÕÔÅÍ ×ÙÇÒÕÚËÉ ÍÏÄÕÌÑ ÐÏÌÉÔÉËÉ.
	åÓÌÉ ÐÏÌÉÔÉËÁ ÂÙÌÁ ÐÏÓÔÏÑÎÎÏ ÉÌÉ ×ÒÅÍÅÎÎÏ ÏÔËÌÀÞÅÎÁ, ÂÁÚÕ ÄÁÎÎÙÈ
	login ÎÅÏÂÈÏÄÉÍÏ ÐÅÒÅÎÁÓÔÒÏÉÔØ.  ä×ÁÖÄÙ ÐÒÏ×ÅÒØÔÅ
	<filename>login.conf</filename>, ÞÔÏÂÙ ÕÂÅÄÉÔØÓÑ, ÞÔÏ
	×ÓÅ ÐÁÒÁÍÅÔÒÙ <option>label</option> ÂÙÌÉ ÕÄÁÌÅÎÙ É ÐÅÒÅÓÏÂÅÒÉÔÅ
	ÂÁÚÕ ÄÁÎÎÙÈ ËÏÍÁÎÄÏÊ <command>cap_mkdb</command>.</para>
    </sect2>
  </sect1>
</chapter>

<!--
     Local Variables:
     mode: sgml
     sgml-declaration: "../chapter.decl"
     sgml-indent-data: t
     sgml-omittag: nil
     sgml-always-quote-attributes: t
     sgml-parent-document: ("../book.sgml" "part" "chapter")
     End:
-->