Index: head/lib/libc/posix1e/mac.3
===================================================================
--- head/lib/libc/posix1e/mac.3	(revision 285872)
+++ head/lib/libc/posix1e/mac.3	(revision 285873)
@@ -1,176 +1,165 @@
 .\" Copyright (c) 2001, 2003 Networks Associates Technology, Inc.
 .\" Copyright (c) 2009 Robert N. M. Watson
 .\" All rights reserved.
 .\"
 .\" This software was developed for the FreeBSD Project by Chris
 .\" Costello at Safeport Network Services and Network Associates
 .\" Laboratories, the Security Research Division of Network Associates,
 .\" Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part
 .\" of the DARPA CHATS research program.
 .\"
 .\" Redistribution and use in source and binary forms, with or without
 .\" modification, are permitted provided that the following conditions
 .\" are met:
 .\" 1. Redistributions of source code must retain the above copyright
 .\"    notice, this list of conditions and the following disclaimer.
 .\" 2. Redistributions in binary form must reproduce the above copyright
 .\"    notice, this list of conditions and the following disclaimer in the
 .\"    documentation and/or other materials provided with the distribution.
 .\"
 .\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 .\" ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
 .\" $FreeBSD$
 .\"
-.Dd August 7, 2009
+.Dd July 25, 2015
 .Dt MAC 3
 .Os
 .Sh NAME
 .Nm mac
 .Nd introduction to the MAC security API
 .Sh LIBRARY
 .Lb libc
 .Sh SYNOPSIS
 .In sys/mac.h
 .Pp
 In the kernel configuration file:
 .Cd "options MAC"
 .Sh DESCRIPTION
 Mandatory Access Control labels describe confidentiality, integrity, and
 other security attributes of operating system objects, overriding
 discretionary access control.
 Not all system objects support MAC labeling, and MAC policies must be
 explicitly enabled by the administrator.
 This API, based on POSIX.1e, includes routines to retrieve, manipulate, set,
 and convert to and from text the MAC labels on files and processes.
 .Pp
 MAC labels consist of a set of (name, value) tuples, representing security
 attributes from MAC policies.
 For example, this label contains security labels defined by two policies,
 .Xr mac_biba 4
 and
 .Xr mac_mls 4 :
 .Bd -literal -offset indent
 biba/low,mls/low
 .Ed
 .Pp
 Further syntax and semantics of MAC labels may be found in
 .Xr maclabel 7 .
 .Pp
 Applications operate on labels stored in
 .Vt mac_t ,
 but can convert between this internal format and a text format for the
 purposes of presentation to uses or external storage.
 When querying a label on an object, a
 .Vt mac_t
 must first be prepared using the interfaces described in
 .Xr mac_prepare 3 ,
 allowing the application to declare which policies it wishes to interrogate.
 The application writer can also rely on default label names declared in
 .Xr mac.conf 5 .
 .Pp
 When finished with a
 .Vt mac_t ,
 the application must call
 .Xr mac_free 3
 to release its storage.
 .Pp
 The following functions are defined:
 .Bl -tag -width indent
 .It Fn mac_is_present
 This function, described in
 .Xr mac_is_present 3 ,
 allows applications to test whether MAC is configured, as well as whether
 specific policies are configured.
 .It Fn mac_get_fd , Fn mac_get_file , Fn mac_get_link , Fn mac_get_peer
 These functions, described in
 .Xr mac_get 3 ,
 retrieve the MAC labels associated with file descriptors, files, and socket
 peers.
 .It Fn mac_get_pid , Fn mac_get_proc
 These functions, described in
 .Xr mac_get 3 ,
 retrieve the MAC labels associated with processes.
 .It Fn mac_set_fd , Fn mac_set_file , Fn mac_set_link
 These functions, described in
 .Xr mac_set 3 ,
 set the MAC labels associated with file descriptors and files.
 .It Fn mac_set_proc
 This function, described in
 .Xr mac_set 3 ,
 sets the MAC label associated with the current process.
 .It Fn mac_free
 This function, described in
 .Xr mac_free 3 ,
 frees working MAC label storage.
 .It Fn mac_from_text
 This function, described in
 .Xr mac_text 3 ,
 converts a text-form MAC label into working MAC label storage,
 .Vt mac_t .
 .It Fn mac_prepare , Fn mac_prepare_file_label , Fn mac_prepare_ifnet_label , Fn mac_prepare_process_label , Fn mac_prepare_type
 These functions,  described in
 .Xr mac_prepare 3 ,
 allocate working storage for MAC label operations.
 .Xr mac_prepare 3
 prepares a label based on caller-specified label names; the other calls
 rely on the default configuration specified in
 .Xr mac.conf 5 .
 .It Fn mac_to_text
 This function is described in
 .Xr mac_text 3 ,
 and may be used to convert a
 .Vt mac_t
 into a text-form MAC label.
 .El
 .Sh FILES
 .Bl -tag -width ".Pa /etc/mac.conf" -compact
 .It Pa /etc/mac.conf
 MAC library configuration file, documented in
 .Xr mac.conf 5 .
 Provides default behavior for applications aware of MAC labels on
 system objects, but without policy-specific knowledge.
 .El
 .Sh SEE ALSO
 .Xr mac_free 3 ,
 .Xr mac_get 3 ,
 .Xr mac_is_present 3 ,
 .Xr mac_prepare 3 ,
 .Xr mac_set 3 ,
 .Xr mac_text 3 ,
 .Xr posix1e 3 ,
 .Xr mac 4 ,
 .Xr mac.conf 5 ,
 .Xr mac 9
 .Sh STANDARDS
 These APIs are loosely based on the APIs described in POSIX.1e, as described
 in IEEE POSIX.1e draft 17.
 However, the resemblance of these APIs to the POSIX APIs is loose, as the
 POSIX APIs were unable to express some notions required for flexible and
 extensible access control.
 .Sh HISTORY
 Support for Mandatory Access Control was introduced in
 .Fx 5.0
 as part of the
 .Tn TrustedBSD
 Project.
-.Sh BUGS
-The
-.Tn TrustedBSD
-MAC Framework and associated policies, interfaces, and
-applications are considered to be an experimental feature in
-.Fx .
-Sites considering production deployment should keep the experimental
-status of these services in mind during any deployment process.
-See also
-.Xr mac 9
-for related considerations regarding the kernel framework.
Index: head/lib/libc/posix1e/mac.conf.5
===================================================================
--- head/lib/libc/posix1e/mac.conf.5	(revision 285872)
+++ head/lib/libc/posix1e/mac.conf.5	(revision 285873)
@@ -1,123 +1,112 @@
 .\" Copyright (c) 2003 Networks Associates Technology, Inc.
 .\" All rights reserved.
 .\"
 .\" This software was developed for the FreeBSD Project in part by Network
 .\" Associates Laboratories, the Security Research Division of Network
 .\" Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
 .\" as part of the DARPA CHATS research program.
 .\"
 .\" Redistribution and use in source and binary forms, with or without
 .\" modification, are permitted provided that the following conditions
 .\" are met:
 .\" 1. Redistributions of source code must retain the above copyright
 .\"    notice, this list of conditions and the following disclaimer.
 .\" 2. Redistributions in binary form must reproduce the above copyright
 .\"    notice, this list of conditions and the following disclaimer in the
 .\"    documentation and/or other materials provided with the distribution.
 .\"
 .\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 .\" ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
 .\" $FreeBSD$
 .\"
-.Dd April 19, 2003
+.Dd July 25, 2015
 .Dt MAC.CONF 5
 .Os
 .Sh NAME
 .Nm mac.conf
 .Nd format of the MAC library configuration file
 .Sh DESCRIPTION
 The
 .Nm
 file configures the default label elements to be used by policy-agnostic
 applications that operate on MAC labels.
 A file contains a series of default label sets specified by object class,
 in addition to blank lines and comments preceded by a
 .Ql #
 symbol.
 .Pp
 Currently, the implementation supports two syntax styles for label
 element declaration.
 The old (deprecated) syntax consists of a
 single line with two fields separated by white space: the object
 class name, and a list of label elements as used by the
 .Xr mac_prepare 3
 library calls prior to an application invocation of a function from
 .Xr mac_get 3 .
 .Pp
 The newer more preferred syntax consists of three fields separated by
 white space: the label group, object class name and a list of
 label elements.
 .Pp
 Label element names may optionally begin with a
 .Ql \&?
 symbol to indicate that a failure to retrieve the label element for
 an object should be silently ignored, and improves usability if the
 set of MAC policies may change over time.
 .Sh FILES
 .Bl -tag -width ".Pa /etc/mac.conf" -compact
 .It Pa /etc/mac.conf
 MAC library configuration file.
 .El
 .Sh EXAMPLES
 The following example configures user applications to operate with
 four MAC policies:
 .Xr mac_biba 4 ,
 .Xr mac_mls 4 ,
 SEBSD,
 and
 .Xr mac_partition 4 .
 .Bd -literal -offset indent
 #
 # Default label set to be used by simple MAC applications
 
 default_labels file ?biba,?lomac,?mls,?sebsd
 default_labels ifnet ?biba,?lomac,?mls,?sebsd
 default_labels process ?biba,?lomac,?mls,?partition,?sebsd
 default_labels socket ?biba,?lomac,?mls
 
 #
 # Deprecated (old) syntax
 
 default_file_labels ?biba,?mls,?sebsd
 default_ifnet_labels ?biba,?mls,?sebsd
 default_process_labels ?biba,?mls,partition,?sebsd
 .Ed
 .Pp
 In this example, userland applications will attempt to retrieve Biba,
 MLS, and SEBSD labels for all object classes; for processes, they will
 additionally attempt to retrieve a Partition identifier.
 In all cases except the Partition identifier, failure to retrieve a
 label due to the respective policy not being present will be ignored.
 .Sh SEE ALSO
 .Xr mac 3 ,
 .Xr mac_get 3 ,
 .Xr mac_prepare 3 ,
 .Xr mac 4 ,
 .Xr mac 9
 .Sh HISTORY
 Support for Mandatory Access Control was introduced in
 .Fx 5.0
 as part of the
 .Tn TrustedBSD
 Project.
-.Sh BUGS
-The
-.Tn TrustedBSD
-MAC Framework and associated policies, interfaces, and
-applications are considered to be an experimental feature in
-.Fx .
-Sites considering production deployment should keep the experimental
-status of these services in mind during any deployment process.
-See also
-.Xr mac 9
-for related considerations regarding the kernel framework.
Index: head/share/man/man4/capsicum.4
===================================================================
--- head/share/man/man4/capsicum.4	(revision 285872)
+++ head/share/man/man4/capsicum.4	(revision 285873)
@@ -1,131 +1,127 @@
 .\"
 .\" Copyright (c) 2011, 2013 Robert N. M. Watson
 .\" Copyright (c) 2011 Jonathan Anderson
 .\" All rights reserved.
 .\"
 .\" Redistribution and use in source and binary forms, with or without
 .\" modification, are permitted provided that the following conditions
 .\" are met:
 .\" 1. Redistributions of source code must retain the above copyright
 .\"    notice, this list of conditions and the following disclaimer.
 .\" 2. Redistributions in binary form must reproduce the above copyright
 .\"    notice, this list of conditions and the following disclaimer in the
 .\"    documentation and/or other materials provided with the distribution.
 .\"
 .\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 .\" ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
 .\" $FreeBSD$
 .\"
-.Dd October 19, 2013
+.Dd July 25, 2015
 .Dt CAPSICUM 4
 .Os
 .Sh NAME
 .Nm Capsicum
 .Nd lightweight OS capability and sandbox framework
 .Sh SYNOPSIS
 .Cd "options CAPABILITY_MODE"
 .Cd "options CAPABILITIES"
 .Sh DESCRIPTION
 .Nm
 is a lightweight OS capability and sandbox framework implementing a hybrid
 capability system model.
 .Nm
 can be used for application and library compartmentalisation, the
 decomposition of larger bodies of software into isolated (sandboxed)
 components in order to implement security policies and limit the impact of
 software vulnerabilities.
 .Pp
 .Nm
 provides two core kernel primitives:
 .Bl -tag -width indent
 .It capability mode
 A process mode, entered by invoking
 .Xr cap_enter 2 ,
 in which access to global OS namespaces (such as the file system and PID
 namespaces) is restricted; only explicitly delegated rights, referenced by
 memory mappings or file descriptors, may be used.
 Once set, the flag is inherited by future children processes, and may not be
 cleared.
 .It capabilities
 Limit operations that can be called on file descriptors.
 For example, a file descriptor returned by
 .Xr open 2
 may be refined using
 .Xr cap_rights_limit 2
 so that only
 .Xr read 2
 and
 .Xr write 2
 can be called, but not
 .Xr fchmod 2 .
 The complete list of the capability rights can be found in the
 .Xr rights 4
 manual page.
 .El
 .Pp
 In some cases,
 .Nm
 requires use of alternatives to traditional POSIX APIs in order to name
 objects using capabilities rather than global namespaces:
 .Bl -tag -width indent
 .It process descriptors
 File descriptors representing processes, allowing parent processes to manage
 child processes without requiring access to the PID namespace; described in
 greater detail in
 .Xr procdesc 4 .
 .It anonymous shared memory
 An extension to the POSIX shared memory API to support anonymous swap objects
 associated with file descriptors; described in greater detail in
 .Xr shm_open 2 .
 .El
 .Sh SEE ALSO
 .Xr cap_enter 2 ,
 .Xr cap_fcntls_limit 2 ,
 .Xr cap_getmode 2 ,
 .Xr cap_ioctls_limit 2 ,
 .Xr cap_rights_limit 2 ,
 .Xr fchmod 2 ,
 .Xr open 2 ,
 .Xr pdfork 2 ,
 .Xr pdgetpid 2 ,
 .Xr pdkill 2 ,
 .Xr pdwait4 2 ,
 .Xr read 2 ,
 .Xr shm_open 2 ,
 .Xr write 2 ,
 .Xr cap_rights_get 3 ,
 .Xr libcapsicum 3 ,
 .Xr procdesc 4 ,
 .Xr casperd 8
 .Sh HISTORY
 .Nm
 first appeared in
 .Fx 9.0 ,
 and was developed at the University of Cambridge.
 .Sh AUTHORS
 .Nm
 was developed by
 .An -nosplit
 .An Robert Watson Aq Mt rwatson@FreeBSD.org
 and
 .An Jonathan Anderson Aq Mt jonathan@FreeBSD.org
 at the University of Cambridge, and
 .An Ben Laurie Aq Mt benl@FreeBSD.org
 and
 .An Kris Kennaway Aq Mt kris@FreeBSD.org
 at Google, Inc., and
 .An Pawel Jakub Dawidek Aq Mt pawel@dawidek.net .
-.Sh BUGS
-.Nm
-is considered experimental in
-.Fx .
Index: head/share/man/man4/mac.4
===================================================================
--- head/share/man/man4/mac.4	(revision 285872)
+++ head/share/man/man4/mac.4	(revision 285873)
@@ -1,254 +1,246 @@
 .\" Copyright (c) 2003 Networks Associates Technology, Inc.
 .\" All rights reserved.
 .\"
 .\" This software was developed for the FreeBSD Project by Chris Costello
 .\" at Safeport Network Services and Network Associates Labs, the
 .\" Security Research Division of Network Associates, Inc. under
 .\" DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the
 .\" DARPA CHATS research program.
 .\"
 .\" Redistribution and use in source and binary forms, with or without
 .\" modification, are permitted provided that the following conditions
 .\" are met:
 .\" 1. Redistributions of source code must retain the above copyright
 .\"    notice, this list of conditions and the following disclaimer.
 .\" 2. Redistributions in binary form must reproduce the above copyright
 .\"    notice, this list of conditions and the following disclaimer in the
 .\"    documentation and/or other materials provided with the distribution.
 .\"
 .\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 .\" ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
 .\" $FreeBSD$
 .\"
-.Dd October 30, 2007
+.Dd July 25, 2015
 .Dt MAC 4
 .Os
 .Sh NAME
 .Nm mac
 .Nd Mandatory Access Control
 .Sh SYNOPSIS
 .Cd "options MAC"
 .Sh DESCRIPTION
 .Ss Introduction
 The Mandatory Access Control, or MAC, framework allows administrators to
 finely control system security by providing for a loadable security policy
 architecture.
 It is important to note that due to its nature, MAC security policies may
 only restrict access relative to one another and the base system policy;
 they cannot override traditional
 .Ux
 security provisions such as file permissions and superuser checks.
 .Pp
 Currently, the following MAC policy modules are shipped with
 .Fx :
 .Bl -column ".Xr mac_seeotheruids 4" "low-watermark mac policy" ".Em Labeling" "boot only"
 .It Sy Name Ta Sy Description Ta Sy Labeling Ta Sy "Load time"
 .It Xr mac_biba 4 Ta "Biba integrity policy" Ta yes Ta boot only
 .It Xr mac_bsdextended 4 Ta "File system firewall" Ta no Ta any time
 .It Xr mac_ifoff 4 Ta "Interface silencing" Ta no Ta any time
 .It Xr mac_lomac 4 Ta "Low-Watermark MAC policy" Ta yes Ta boot only
 .It Xr mac_mls 4 Ta "Confidentiality policy" Ta yes Ta boot only
 .It Xr mac_none 4 Ta "Sample no-op policy" Ta no Ta any time
 .It Xr mac_partition 4 Ta "Process partition policy" Ta yes Ta any time
 .It Xr mac_portacl 4 Ta "Port bind(2) access control" Ta no Ta any time
 .It Xr mac_seeotheruids 4 Ta "See-other-UIDs policy" Ta no Ta any time
 .It Xr mac_test 4 Ta "MAC testing policy" Ta no Ta any time
 .El
 .Ss MAC Labels
 Each system subject (processes, sockets, etc.) and each system object
 (file system objects, sockets, etc.) can carry with it a MAC label.
 MAC labels contain data in an arbitrary format
 taken into consideration in making access control decisions
 for a given operation.
 Most MAC labels on system subjects and objects
 can be modified directly or indirectly by the system
 administrator.
 The format for a given policy's label may vary depending on the type
 of object or subject being labeled.
 More information on the format for MAC labels can be found in the
 .Xr maclabel 7
 man page.
 .Ss MAC Support for UFS2 File Systems
 By default, file system enforcement of labeled MAC policies relies on
 a single file system label
 (see
 .Sx "MAC Labels" )
 in order to make access control decisions for all the files in a particular
 file system.
 With some policies, this configuration may not allow administrators to take
 full advantage of features.
 In order to enable support for labeling files on an individual basis
 for a particular file system,
 the
 .Dq multilabel
 flag must be enabled on the file system.
 To set the
 .Dq multilabel
 flag, drop to single-user mode and unmount the file system,
 then execute the following command:
 .Pp
 .Dl "tunefs -l enable" Ar filesystem
 .Pp
 where
 .Ar filesystem
 is either the mount point
 (in
 .Xr fstab 5 )
 or the special file
 (in
 .Pa /dev )
 corresponding to the file system on which to enable multilabel support.
 .Ss Policy Enforcement
 Policy enforcement is divided into the following areas of the system:
 .Bl -ohang
 .It Sy "File System"
 File system mounts, modifying directories, modifying files, etc.
 .It Sy KLD
 Loading, unloading, and retrieving statistics on loaded kernel modules
 .It Sy Network
 Network interfaces,
 .Xr bpf 4 ,
 packet delivery and transmission,
 interface configuration
 .Xr ( ioctl 2 ,
 .Xr ifconfig 8 )
 .It Sy Pipes
 Creation of and operation on
 .Xr pipe 2
 objects
 .It Sy Processes
 Debugging
 (e.g.\&
 .Xr ktrace 2 ) ,
 process visibility
 .Pq Xr ps 1 ,
 process execution
 .Pq Xr execve 2 ,
 signalling
 .Pq Xr kill 2
 .It Sy Sockets
 Creation of and operation on
 .Xr socket 2
 objects
 .It Sy System
 Kernel environment
 .Pq Xr kenv 1 ,
 system accounting
 .Pq Xr acct 2 ,
 .Xr reboot 2 ,
 .Xr settimeofday 2 ,
 .Xr swapon 2 ,
 .Xr sysctl 3 ,
 .Xr nfsd 8 Ns
 -related operations
 .It Sy VM
 .Xr mmap 2 Ns
 -ed files
 .El
 .Ss Setting MAC Labels
 From the command line, each type of system object has its own means for setting
 and modifying its MAC policy label.
 .Bl -column "user (by login class)" "Xr setfmac 8 , Xr setfsmac 8" -offset indent
 .It Sy "Subject/Object" Ta Sy "Utility"
 .It "File system object" Ta Xr setfmac 8 , Xr setfsmac 8
 .It "Network interface" Ta Xr ifconfig 8
 .It "TTY (by login class)" Ta Xr login.conf 5
 .It "User (by login class)" Ta Xr login.conf 5
 .El
 .Pp
 Additionally, the
 .Xr su 1
 and
 .Xr setpmac 8
 utilities can be used to run a command with a different process label than
 the shell's current label.
 .Ss Programming With MAC
 MAC security enforcement itself is transparent to application
 programs, with the exception that some programs may need to be aware of
 additional
 .Xr errno 2
 returns from various system calls.
 .Pp
 The interface for retrieving, handling, and setting policy labels
 is documented in the
 .Xr mac 3
 man page.
 .\" *** XXX ***
 .\" Support for this feature is poor and should not be encouraged.
 .\"
 .\" .It Va security.mac.mmap_revocation
 .\" Revoke
 .\" .Xr mmap 2
 .\" access to files on subject relabel.
 .\" .It Va security.mac.mmap_revocation_via_cow
 .\" Revoke
 .\" .Xr mmap 2
 .\" access to files via copy-on-write semantics;
 .\" mapped regions will still appear writable, but will no longer
 .\" effect a change on the underlying vnode.
 .\" (Default: 0).
 .Sh SEE ALSO
 .Xr mac 3 ,
 .Xr mac_biba 4 ,
 .Xr mac_bsdextended 4 ,
 .Xr mac_ifoff 4 ,
 .Xr mac_lomac 4 ,
 .Xr mac_mls 4 ,
 .Xr mac_none 4 ,
 .Xr mac_partition 4 ,
 .Xr mac_portacl 4 ,
 .Xr mac_seeotheruids 4 ,
 .Xr mac_test 4 ,
 .Xr login.conf 5 ,
 .Xr maclabel 7 ,
 .Xr getfmac 8 ,
 .Xr getpmac 8 ,
 .Xr setfmac 8 ,
 .Xr setpmac 8 ,
 .Xr mac 9
 .Rs
 .%B "The FreeBSD Handbook"
 .%T "Mandatory Access Control"
 .%U http://www.FreeBSD.org/doc/en_US.ISO8859-1/books/handbook/mac.html
 .Re
 .Sh HISTORY
 The
 .Nm
 implementation first appeared in
 .Fx 5.0
 and was developed by the
 .Tn TrustedBSD
 Project.
 .Sh AUTHORS
 This software was contributed to the
 .Fx
 Project by Network Associates Labs,
 the Security Research Division of Network Associates
 Inc.
 under DARPA/SPAWAR contract N66001-01-C-8035
 .Pq Dq CBOSS ,
 as part of the DARPA CHATS research program.
 .Sh BUGS
-See
-.Xr mac 9
-concerning appropriateness for production use.
-The
-.Tn TrustedBSD
-MAC Framework is considered experimental in
-.Fx .
-.Pp
 While the MAC Framework design is intended to support the containment of
 the root user, not all attack channels are currently protected by entry
 point checks.
 As such, MAC Framework policies should not be relied on, in isolation,
 to protect against a malicious privileged user.
Index: head/share/man/man4/mac_ifoff.4
===================================================================
--- head/share/man/man4/mac_ifoff.4	(revision 285872)
+++ head/share/man/man4/mac_ifoff.4	(revision 285873)
@@ -1,133 +1,125 @@
 .\" Copyright (c) 2002 Networks Associates Technology, Inc.
 .\" All rights reserved.
 .\"
 .\" This software was developed for the FreeBSD Project by Chris Costello
 .\" at Safeport Network Services and Network Associates Laboratories, the
 .\" Security Research Division of Network Associates, Inc. under
 .\" DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the
 .\" DARPA CHATS research program.
 .\"
 .\" Redistribution and use in source and binary forms, with or without
 .\" modification, are permitted provided that the following conditions
 .\" are met:
 .\" 1. Redistributions of source code must retain the above copyright
 .\"    notice, this list of conditions and the following disclaimer.
 .\" 2. Redistributions in binary form must reproduce the above copyright
 .\"    notice, this list of conditions and the following disclaimer in the
 .\"    documentation and/or other materials provided with the distribution.
 .\"
 .\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 .\" ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
 .\" $FreeBSD$
 .\"
-.Dd December 10, 2002
+.Dd July 25, 2015
 .Dt MAC_IFOFF 4
 .Os
 .Sh NAME
 .Nm mac_ifoff
 .Nd "interface silencing policy"
 .Sh SYNOPSIS
 To compile the interface silencing policy into your kernel,
 place the following lines in your kernel
 configuration file:
 .Bd -ragged -offset indent
 .Cd "options MAC"
 .Cd "options MAC_IFOFF"
 .Ed
 .Pp
 Alternately, to load the interface silencing policy module at boot time,
 place the following line in your kernel configuration file:
 .Bd -ragged -offset indent
 .Cd "options MAC"
 .Ed
 .Pp
 and in
 .Xr loader.conf 5 :
 .Bd -literal -offset indent
 mac_ifoff_load="YES"
 .Ed
 .Sh DESCRIPTION
 The
 .Nm
 interface silencing module allows administrators to enable and disable
 incoming and outgoing data flow on system network interfaces
 via the
 .Xr sysctl 8
 interface.
 .Pp
 To disable network traffic over the loopback
 .Pq Xr lo 4
 interface, set the
 .Xr sysctl 8
 OID
 .Va security.mac.ifoff.lo_enabled
 to 0 (default 1).
 .Pp
 To enable network traffic over other interfaces,
 set the
 .Xr sysctl 8
 OID
 .Va security.mac.ifoff.other_enabled
 to 1 (default 0).
 .Pp
 To allow BPF traffic to be received,
 even while other traffic is disabled,
 set the
 .Xr sysctl 8
 OID
 .Va security.mac.ifoff.bpfrecv_enabled
 to 1 (default 0).
 .Ss Label Format
 No labels are defined.
 .Sh SEE ALSO
 .Xr mac 4 ,
 .Xr mac_bsdextended 4 ,
 .Xr mac_lomac 4 ,
 .Xr mac_mls 4 ,
 .Xr mac_none 4 ,
 .Xr mac_partition 4 ,
 .Xr mac_portacl 4 ,
 .Xr mac_seeotheruids 4 ,
 .Xr mac_test 4 ,
 .Xr mac 9
 .Sh HISTORY
 The
 .Nm
 policy module first appeared in
 .Fx 5.0
 and was developed by the
 .Tn TrustedBSD
 Project.
 .Sh AUTHORS
 This software was contributed to the
 .Fx
 Project by Network Associates Labs,
 the Security Research Division of Network Associates
 Inc.
 under DARPA/SPAWAR contract N66001-01-C-8035
 .Pq Dq CBOSS ,
 as part of the DARPA CHATS research program.
 .Sh BUGS
-See
-.Xr mac 9
-concerning appropriateness for production use.
-The
-.Tn TrustedBSD
-MAC Framework is considered experimental in
-.Fx .
-.Pp
 While the MAC Framework design is intended to support the containment of
 the root user, not all attack channels are currently protected by entry
 point checks.
 As such, MAC Framework policies should not be relied on, in isolation,
 to protect against a malicious privileged user.
Index: head/share/man/man4/mac_mls.4
===================================================================
--- head/share/man/man4/mac_mls.4	(revision 285872)
+++ head/share/man/man4/mac_mls.4	(revision 285873)
@@ -1,251 +1,243 @@
 .\" Copyright (c) 2002-2004 Networks Associates Technology, Inc.
 .\" All rights reserved.
 .\"
 .\" This software was developed for the FreeBSD Project by Chris Costello
 .\" at Safeport Network Services and Network Associates Laboratories, the
 .\" Security Research Division of Network Associates, Inc. under
 .\" DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the
 .\" DARPA CHATS research program.
 .\"
 .\" Redistribution and use in source and binary forms, with or without
 .\" modification, are permitted provided that the following conditions
 .\" are met:
 .\" 1. Redistributions of source code must retain the above copyright
 .\"    notice, this list of conditions and the following disclaimer.
 .\" 2. Redistributions in binary form must reproduce the above copyright
 .\"    notice, this list of conditions and the following disclaimer in the
 .\"    documentation and/or other materials provided with the distribution.
 .\"
 .\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 .\" ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
 .\" $FreeBSD$
 .\"
-.Dd December 1, 2002
+.Dd July 25, 2015
 .Dt MAC_MLS 4
 .Os
 .Sh NAME
 .Nm mac_mls
 .Nd "Multi-Level Security confidentiality policy"
 .Sh SYNOPSIS
 To compile MLS into your kernel, place the following lines in your kernel
 configuration file:
 .Bd -ragged -offset indent
 .Cd "options MAC"
 .Cd "options MAC_MLS"
 .Ed
 .Pp
 Alternately, to load the MLS module at boot time, place the following line
 in your kernel configuration file:
 .Bd -ragged -offset indent
 .Cd "options MAC"
 .Ed
 .Pp
 and in
 .Xr loader.conf 5 :
 .Bd -literal -offset indent
 mac_mls_load="YES"
 .Ed
 .Sh DESCRIPTION
 The
 .Nm
 policy module implements the Multi-Level Security, or MLS model,
 which controls access between subjects and objects based on their
 confidentiality by means of a strict information flow policy.
 Each subject and object in the system has an MLS label associated with it;
 each subject's MLS label contains information on its clearance level,
 and each object's MLS label contains information on its classification.
 .Pp
 In MLS, all system subjects and objects are assigned confidentiality labels,
 made up of a sensitivity level and zero or more compartments.
 Together, these label elements permit all labels to be placed in a partial
 order, with confidentiality protections based on a dominance operator
 describing the order.
 The sensitivity level is expressed as a value between 0 and
 65535, with higher values reflecting higher sensitivity levels.
 The compartment field is expressed as a set of up to 256 components,
 numbered from 1 to 256.
 A complete label consists of both sensitivity and compartment
 elements.
 .Pp
 With normal labels, dominance is defined as a label having a higher
 or equal active sensitivity level, and having at least
 all of the same compartments as the label to which it is being compared.
 With respect to label comparisons,
 .Dq Li lower
 is defined as being dominated by the label to which it is being compared,
 and
 .Dq Li higher
 is defined as dominating the label to which it is being compared,
 and
 .Dq Li equal
 is defined as both labels being able to satisfy the dominance requirements
 over one another.
 .Pp
 Three special label values exist:
 .Bl -column -offset indent ".Li mls/equal" "dominated by all other labels"
 .It Sy Label Ta Sy Comparison
 .It Li mls/low Ta "dominated by all other labels"
 .It Li mls/equal Ta "equal to all other labels"
 .It Li mls/high Ta "dominates all other labels"
 .El
 .Pp
 The
 .Dq Li mls/equal
 label may be applied to subjects and objects for which no enforcement of the
 MLS security policy is desired.
 .Pp
 The MLS model enforces the following basic restrictions:
 .Bl -bullet
 .It
 Subjects may not observe the processes of another subject if its
 clearance level is lower than the clearance level of the object it is
 attempting to observe.
 .It
 Subjects may not read, write, or otherwise observe objects without proper
 clearance (e.g.\& subjects may not observe objects whose classification label
 dominates its own clearance label)
 .It
 Subjects may not write to objects with a lower classification level than
 its own clearance level.
 .It
 A subject may read and write to an object if its clearance level is equal
 to the object's classification level as though MLS protections were not in
 place.
 .El
 .Pp
 These rules prevent subjects of lower clearance from gaining access
 information classified beyond its clearance level in order to protect the
 confidentiality of classified information, subjects of higher clearance
 from writing to objects of lower classification in order to prevent the
 accidental or malicious leaking of information, and subjects of lower
 clearance from observing subjects of higher clearance altogether.
 In traditional trusted operating systems, the MLS confidentiality model is
 used in concert with the Biba integrity model
 .Xr ( mac_biba 4 )
 in order to protect the Trusted Code Base (TCB).
 .Ss Label Format
 Almost all system objects are tagged with an effective, active label element,
 reflecting the classification of the object, or classification of the data
 contained in the object.
 In general, object labels are represented in the following form:
 .Pp
 .Sm off
 .D1 Li mls / Ar grade : compartments
 .Sm on
 .Pp
 For example:
 .Bd -literal -offset indent
 mls/10:2+3+6
 mls/low
 .Ed
 .Pp
 Subject labels consist of three label elements: an effective (active) label,
 as well as a range of available labels.
 This range is represented using two ordered MLS label elements, and when set
 on a process, permits the process to change its active label to any label of
 greater or equal integrity to the low end of the range, and lesser or equal
 integrity to the high end of the range.
 In general, subject labels are represented in the following form:
 .Pp
 .Sm off
 .D1 Li mls / Ar effectivegrade : effectivecompartments ( lograde : locompartments No -
 .D1 Ar higrade : hicompartments )
 .Sm on
 .Pp
 For example:
 .Bd -literal -offset indent
 mls/10:2+3+6(5:2+3-20:2+3+4+5+6)
 mls/high(low-high)
 .Ed
 .Pp
 Valid ranged labels must meet the following requirement regarding their
 elements:
 .Pp
 .D1 Ar rangehigh No \[>=] Ar effective No \[>=] Ar rangelow
 .Pp
 One class of objects with ranges currently exists, the network interface.
 In the case of the network interface, the effective label element references
 the default label for packets received over the interface, and the range
 represents the range of acceptable labels of packets to be transmitted over
 the interface.
 .Ss Runtime Configuration
 The following
 .Xr sysctl 8
 MIBs are available for fine-tuning the enforcement of this MAC policy.
 .Bl -tag -width ".Va security.mac.mls.ptys_equal"
 .It Va security.mac.mls.enabled
 Enables the enforcement of the MLS confidentiality policy.
 (Default: 1).
 .It Va security.mac.mls.ptys_equal
 Label
 .Xr pty 4 Ns s
 as
 .Dq Li mls/equal
 upon creation.
 (Default: 0).
 .It Va security.mac.mls.revocation_enabled
 Revoke access to objects if the label is changed to a more sensitive
 level than the subject.
 (Default: 0).
 .El
 .Sh IMPLEMENTATION NOTES
 Currently, the
 .Nm
 policy relies on superuser status
 .Pq Xr suser 9
 in order to change network interface MLS labels.
 This will eventually go away, but it is currently a liability and may
 allow the superuser to bypass MLS protections.
 .Sh SEE ALSO
 .Xr mac 4 ,
 .Xr mac_biba 4 ,
 .Xr mac_bsdextended 4 ,
 .Xr mac_ifoff 4 ,
 .Xr mac_lomac 4 ,
 .Xr mac_none 4 ,
 .Xr mac_partition 4 ,
 .Xr mac_portacl 4 ,
 .Xr mac_seeotheruids 4 ,
 .Xr mac_test 4 ,
 .Xr maclabel 7 ,
 .Xr mac 9
 .Sh HISTORY
 The
 .Nm
 policy module first appeared in
 .Fx 5.0
 and was developed by the
 .Tn TrustedBSD
 Project.
 .Sh AUTHORS
 This software was contributed to the
 .Fx
 Project by Network Associates Laboratories,
 the Security Research Division of Network Associates
 Inc.\& under DARPA/SPAWAR contract N66001-01-C-8035
 .Pq Dq CBOSS ,
 as part of the DARPA CHATS research program.
 .Sh BUGS
-See
-.Xr mac 9
-concerning appropriateness for production use.
-The
-.Tn TrustedBSD
-MAC Framework is considered experimental in
-.Fx .
-.Pp
 While the MAC Framework design is intended to support the containment of
 the root user, not all attack channels are currently protected by entry
 point checks.
 As such, MAC Framework policies should not be relied on, in isolation,
 to protect against a malicious privileged user.
Index: head/share/man/man4/mac_none.4
===================================================================
--- head/share/man/man4/mac_none.4	(revision 285872)
+++ head/share/man/man4/mac_none.4	(revision 285873)
@@ -1,113 +1,105 @@
 .\" Copyright (c) 2002, 2003 Networks Associates Technology, Inc.
 .\" All rights reserved.
 .\"
 .\" This software was developed for the FreeBSD Project by Chris Costello
 .\" at Safeport Network Services and Network Associates Laboratories, the
 .\" Security Research Division of Network Associates, Inc. under
 .\" DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the
 .\" DARPA CHATS research program.
 .\"
 .\" Redistribution and use in source and binary forms, with or without
 .\" modification, are permitted provided that the following conditions
 .\" are met:
 .\" 1. Redistributions of source code must retain the above copyright
 .\"    notice, this list of conditions and the following disclaimer.
 .\" 2. Redistributions in binary form must reproduce the above copyright
 .\"    notice, this list of conditions and the following disclaimer in the
 .\"    documentation and/or other materials provided with the distribution.
 .\"
 .\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 .\" ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
 .\" $FreeBSD$
 .\"
-.Dd December 1, 2002
+.Dd July 25, 2015
 .Dt MAC_NONE 4
 .Os
 .Sh NAME
 .Nm mac_none
 .Nd "null MAC policy module"
 .Sh SYNOPSIS
 To compile the null policy
 into your kernel, place the following lines in your kernel
 configuration file:
 .Bd -ragged -offset indent
 .Cd "options MAC"
 .Cd "options MAC_NONE"
 .Ed
 .Pp
 Alternately, to load the none module at boot time, place the following line
 in your kernel configuration file:
 .Bd -ragged -offset indent
 .Cd "options MAC"
 .Ed
 .Pp
 and in
 .Xr loader.conf 5 :
 .Bd -literal -offset indent
 mac_none_load="YES"
 .Ed
 .Sh DESCRIPTION
 The
 .Nm
 policy module implements a none MAC policy that has no effect on
 access control in the system.
 Unlike
 .Xr mac_stub 4 ,
 none of the MAC entry points are defined.
 .Ss Label Format
 No labels are defined for
 .Nm .
 .Sh SEE ALSO
 .Xr mac 4 ,
 .Xr mac_biba 4 ,
 .Xr mac_bsdextended 4 ,
 .Xr mac_ifoff 4 ,
 .Xr mac_lomac 4 ,
 .Xr mac_mls 4 ,
 .Xr mac_partition 4 ,
 .Xr mac_portacl 4 ,
 .Xr mac_seeotheruids 4 ,
 .Xr mac_stub 4 ,
 .Xr mac_test 4 ,
 .Xr mac 9
 .Sh HISTORY
 The
 .Nm
 policy module first appeared in
 .Fx 5.0
 and was developed by the
 .Tn TrustedBSD
 Project.
 .Sh AUTHORS
 This software was contributed to the
 .Fx
 Project by Network Associates Labs,
 the Security Research Division of Network Associates
 Inc.
 under DARPA/SPAWAR contract N66001-01-C-8035
 .Pq Dq CBOSS ,
 as part of the DARPA CHATS research program.
 .Sh BUGS
-See
-.Xr mac 9
-concerning appropriateness for production use.
-The
-.Tn TrustedBSD
-MAC Framework is considered experimental in
-.Fx .
-.Pp
 While the MAC Framework design is intended to support the containment of
 the root user, not all attack channels are currently protected by entry
 point checks.
 As such, MAC Framework policies should not be relied on, in isolation,
 to protect against a malicious privileged user.
Index: head/share/man/man4/mac_partition.4
===================================================================
--- head/share/man/man4/mac_partition.4	(revision 285872)
+++ head/share/man/man4/mac_partition.4	(revision 285873)
@@ -1,133 +1,125 @@
 .\" Copyright (c) 2002 Networks Associates Technology, Inc.
 .\" All rights reserved.
 .\"
 .\" This software was developed for the FreeBSD Project by Chris Costello
 .\" at Safeport Network Services and Network Associates Laboratories, the
 .\" Security Research Division of Network Associates, Inc. under
 .\" DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the
 .\" DARPA CHATS research program.
 .\"
 .\" Redistribution and use in source and binary forms, with or without
 .\" modification, are permitted provided that the following conditions
 .\" are met:
 .\" 1. Redistributions of source code must retain the above copyright
 .\"    notice, this list of conditions and the following disclaimer.
 .\" 2. Redistributions in binary form must reproduce the above copyright
 .\"    notice, this list of conditions and the following disclaimer in the
 .\"    documentation and/or other materials provided with the distribution.
 .\"
 .\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 .\" ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
 .\" $FreeBSD$
 .\"
-.Dd December 9, 2002
+.Dd July 25, 2015
 .Dt MAC_PARTITION 4
 .Os
 .Sh NAME
 .Nm mac_partition
 .Nd "process partition policy"
 .Sh SYNOPSIS
 To compile the process partition policy into your kernel,
 place the following lines in your kernel
 configuration file:
 .Bd -ragged -offset indent
 .Cd "options MAC"
 .Cd "options MAC_PARTITION"
 .Ed
 .Pp
 Alternately, to load the process partition module at boot time,
 place the following line in your kernel configuration file:
 .Bd -ragged -offset indent
 .Cd "options MAC"
 .Ed
 .Pp
 and in
 .Xr loader.conf 5 :
 .Bd -literal -offset indent
 mac_partition_load="YES"
 .Ed
 .Sh DESCRIPTION
 The
 .Nm
 policy module implements a process partition policy,
 which allows administrators to place running processes into
 .Dq partitions ,
 based on their numeric process partition
 (specified in the process's MAC label).
 Processes with a specified partition can only see processes that are in the
 same partition.
 If no partition is specified for a process, it can see all other processes
 in the system
 (subject to other MAC policy restrictions not defined in this man page).
 No provisions for placing processes into multiple partitions are available.
 .Ss Label Format
 Partition labels take on the following format:
 .Pp
 .Sm off
 .Dl Li partition / Ar value
 .Sm on
 .Pp
 Where
 .Ar value
 can be any integer value or
 .Dq Li none .
 For example:
 .Bd -literal -offset indent
 partition/1
 partition/20
 partition/none
 .Ed
 .Sh SEE ALSO
 .Xr mac 4 ,
 .Xr mac_biba 4 ,
 .Xr mac_bsdextended 4 ,
 .Xr mac_ifoff 4 ,
 .Xr mac_lomac 4 ,
 .Xr mac_mls 4 ,
 .Xr mac_none 4 ,
 .Xr mac_portacl 4 ,
 .Xr mac_seeotheruids 4 ,
 .Xr mac_test 4 ,
 .Xr maclabel 7 ,
 .Xr mac 9
 .Sh HISTORY
 The
 .Nm
 policy module first appeared in
 .Fx 5.0
 and was developed by the
 .Tn TrustedBSD
 Project.
 .Sh AUTHORS
 This software was contributed to the
 .Fx
 Project by Network Associates Labs,
 the Security Research Division of Network Associates
 Inc.
 under DARPA/SPAWAR contract N66001-01-C-8035
 .Pq Dq CBOSS ,
 as part of the DARPA CHATS research program.
 .Sh BUGS
-See
-.Xr mac 9
-concerning appropriateness for production use.
-The
-.Tn TrustedBSD
-MAC Framework is considered experimental in
-.Fx .
-.Pp
 While the MAC Framework design is intended to support the containment of
 the root user, not all attack channels are currently protected by entry
 point checks.
 As such, MAC Framework policies should not be relied on, in isolation,
 to protect against a malicious privileged user.
Index: head/share/man/man4/mac_seeotheruids.4
===================================================================
--- head/share/man/man4/mac_seeotheruids.4	(revision 285872)
+++ head/share/man/man4/mac_seeotheruids.4	(revision 285873)
@@ -1,131 +1,123 @@
 .\" Copyright (c) 2002 Networks Associates Technology, Inc.
 .\" All rights reserved.
 .\"
 .\" This software was developed for the FreeBSD Project by Chris Costello
 .\" at Safeport Network Services and Network Associates Laboratories, the
 .\" Security Research Division of Network Associates, Inc. under
 .\" DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the
 .\" DARPA CHATS research program.
 .\"
 .\" Redistribution and use in source and binary forms, with or without
 .\" modification, are permitted provided that the following conditions
 .\" are met:
 .\" 1. Redistributions of source code must retain the above copyright
 .\"    notice, this list of conditions and the following disclaimer.
 .\" 2. Redistributions in binary form must reproduce the above copyright
 .\"    notice, this list of conditions and the following disclaimer in the
 .\"    documentation and/or other materials provided with the distribution.
 .\"
 .\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 .\" ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
 .\" $FreeBSD$
 .\"
-.Dd October 6, 2005
+.Dd July 25, 2015
 .Dt MAC_SEEOTHERUIDS 4
 .Os
 .Sh NAME
 .Nm mac_seeotheruids
 .Nd "simple policy controlling whether users see other users"
 .Sh SYNOPSIS
 To compile the
 policy into your kernel, place the following lines in your kernel
 configuration file:
 .Bd -ragged -offset indent
 .Cd "options MAC"
 .Cd "options MAC_SEEOTHERUIDS"
 .Ed
 .Pp
 Alternately, to load the module at boot time, place the following line
 in your kernel configuration file:
 .Bd -ragged -offset indent
 .Cd "options MAC"
 .Ed
 .Pp
 and in
 .Xr loader.conf 5 :
 .Bd -literal -offset indent
 mac_seeotheruids_load="YES"
 .Ed
 .Sh DESCRIPTION
 The
 .Nm
 policy module, when enabled, denies users to see processes or sockets owned
 by other users.
 .Pp
 To enable
 .Nm ,
 set the sysctl OID
 .Va security.mac.seeotheruids.enabled
 to 1.
 To permit superuser awareness of other credentials by virtue of privilege,
 set the sysctl OID
 .Va security.mac.seeotheruids.suser_privileged
 to 1.
 .Pp
 To allow users to see processes and sockets owned by the same primary group,
 set the sysctl OID
 .Va security.mac.seeotheruids.primarygroup_enabled
 to 1.
 .Pp
 To allow processes with a specific group ID to be exempt from the policy,
 set the sysctl OID
 .Va security.mac.seeotheruids.specificgid_enabled
 to 1, and
 .Va security.mac.seeotheruids.specificgid
 to the group ID to be exempted.
 .Ss Label Format
 No labels are defined for
 .Nm .
 .Sh SEE ALSO
 .Xr mac 4 ,
 .Xr mac_biba 4 ,
 .Xr mac_bsdextended 4 ,
 .Xr mac_ifoff 4 ,
 .Xr mac_lomac 4 ,
 .Xr mac_mls 4 ,
 .Xr mac_none 4 ,
 .Xr mac_partition 4 ,
 .Xr mac_portacl 4 ,
 .Xr mac_test 4 ,
 .Xr mac 9
 .Sh HISTORY
 The
 .Nm
 policy module first appeared in
 .Fx 5.0
 and was developed by the
 .Tn TrustedBSD
 Project.
 .Sh AUTHORS
 This software was contributed to the
 .Fx
 Project by Network Associates Labs,
 the Security Research Division of Network Associates
 Inc.
 under DARPA/SPAWAR contract N66001-01-C-8035
 .Pq Dq CBOSS ,
 as part of the DARPA CHATS research program.
 .Sh BUGS
-See
-.Xr mac 9
-concerning appropriateness for production use.
-The
-.Tn TrustedBSD
-MAC Framework is considered experimental in
-.Fx .
-.Pp
 While the MAC Framework design is intended to support the containment of
 the root user, not all attack channels are currently protected by entry
 point checks.
 As such, MAC Framework policies should not be relied on, in isolation,
 to protect against a malicious privileged user.
Index: head/share/man/man4/mac_stub.4
===================================================================
--- head/share/man/man4/mac_stub.4	(revision 285872)
+++ head/share/man/man4/mac_stub.4	(revision 285873)
@@ -1,116 +1,108 @@
 .\" Copyright (c) 2002, 2003 Networks Associates Technology, Inc.
 .\" All rights reserved.
 .\"
 .\" This software was developed for the FreeBSD Project by Chris Costello
 .\" at Safeport Network Services and Network Associates Laboratories, the
 .\" Security Research Division of Network Associates, Inc. under
 .\" DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the
 .\" DARPA CHATS research program.
 .\"
 .\" Redistribution and use in source and binary forms, with or without
 .\" modification, are permitted provided that the following conditions
 .\" are met:
 .\" 1. Redistributions of source code must retain the above copyright
 .\"    notice, this list of conditions and the following disclaimer.
 .\" 2. Redistributions in binary form must reproduce the above copyright
 .\"    notice, this list of conditions and the following disclaimer in the
 .\"    documentation and/or other materials provided with the distribution.
 .\"
 .\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 .\" ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
 .\" $FreeBSD$
 .\"
-.Dd December 1, 2002
+.Dd July 25, 2015
 .Dt MAC_STUB 4
 .Os
 .Sh NAME
 .Nm mac_stub
 .Nd "MAC policy stub module"
 .Sh SYNOPSIS
 To compile the stub policy
 into your kernel, place the following lines in your kernel
 configuration file:
 .Bd -ragged -offset indent
 .Cd "options MAC"
 .Cd "options MAC_STUB"
 .Ed
 .Pp
 Alternately, to load the stub module at boot time, place the following line
 in your kernel configuration file:
 .Bd -ragged -offset indent
 .Cd "options MAC"
 .Ed
 .Pp
 and in
 .Xr loader.conf 5 :
 .Bd -literal -offset indent
 mac_stub_load="YES"
 .Ed
 .Sh DESCRIPTION
 The
 .Nm
 policy module implements a stub MAC policy that has no effect on
 access control in the system.
 Unlike
 .Xr mac_none 4 ,
 each MAC entry point is defined as a
 .Dq no-op ,
 so the policy module will be entered for each event, but no change
 in system behavior should result.
 .Ss Label Format
 No labels are defined for
 .Nm .
 .Sh SEE ALSO
 .Xr mac 4 ,
 .Xr mac_biba 4 ,
 .Xr mac_bsdextended 4 ,
 .Xr mac_ifoff 4 ,
 .Xr mac_lomac 4 ,
 .Xr mac_mls 4 ,
 .Xr mac_none 4 ,
 .Xr mac_partition 4 ,
 .Xr mac_portacl 4 ,
 .Xr mac_seeotheruids 4 ,
 .Xr mac_test 4 ,
 .Xr mac 9
 .Sh HISTORY
 The
 .Nm
 policy module first appeared in
 .Fx 5.1
 and was developed by the
 .Tn TrustedBSD
 Project.
 .Sh AUTHORS
 This software was contributed to the
 .Fx
 Project by Network Associates Labs,
 the Security Research Division of Network Associates
 Inc.
 under DARPA/SPAWAR contract N66001-01-C-8035
 .Pq Dq CBOSS ,
 as part of the DARPA CHATS research program.
 .Sh BUGS
-See
-.Xr mac 9
-concerning appropriateness for production use.
-The
-.Tn TrustedBSD
-MAC Framework is considered experimental in
-.Fx .
-.Pp
 While the MAC Framework design is intended to support the containment of
 the root user, not all attack channels are currently protected by entry
 point checks.
 As such, MAC Framework policies should not be relied on, in isolation,
 to protect against a malicious privileged user.
Index: head/share/man/man4/mac_test.4
===================================================================
--- head/share/man/man4/mac_test.4	(revision 285872)
+++ head/share/man/man4/mac_test.4	(revision 285873)
@@ -1,117 +1,109 @@
 .\" Copyright (c) 2002 Networks Associates Technology, Inc.
 .\" All rights reserved.
 .\"
 .\" This software was developed for the FreeBSD Project by Chris Costello
 .\" at Safeport Network Services and Network Associates Laboratories, the
 .\" Security Research Division of Network Associates, Inc. under
 .\" DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the
 .\" DARPA CHATS research program.
 .\"
 .\" Redistribution and use in source and binary forms, with or without
 .\" modification, are permitted provided that the following conditions
 .\" are met:
 .\" 1. Redistributions of source code must retain the above copyright
 .\"    notice, this list of conditions and the following disclaimer.
 .\" 2. Redistributions in binary form must reproduce the above copyright
 .\"    notice, this list of conditions and the following disclaimer in the
 .\"    documentation and/or other materials provided with the distribution.
 .\"
 .\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 .\" ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
 .\" $FreeBSD$
 .\"
-.Dd December 1, 2002
+.Dd July 25, 2015
 .Dt MAC_TEST 4
 .Os
 .Sh NAME
 .Nm mac_test
 .Nd MAC framework testing policy
 .Sh SYNOPSIS
 To compile the testing policy
 into your kernel, place the following lines in your kernel
 configuration file:
 .Bd -ragged -offset indent
 .Cd "options MAC"
 .Cd "options MAC_TEST"
 .Ed
 .Pp
 Alternately, to load the testing module at boot time, place the following line
 in your kernel configuration file:
 .Bd -ragged -offset indent
 .Cd "options MAC"
 .Ed
 .Pp
 and in
 .Xr loader.conf 5 :
 .Bd -literal -offset indent
 mac_test_load="YES"
 .Ed
 .Sh DESCRIPTION
 The
 .Nm
 policy module implements a testing facility for the MAC framework.
 Among other things,
 .Nm
 will try to catch corrupt labels the system is attempting to destroy and
 drop to the debugger.
 Additionally, a set of statistics regarding the number of times various
 MAC framework entry points have been called is stored in the
 .Va security.mac.test
 .Xr sysctl 8
 tree.
 .Ss Label Format
 No labels are defined for
 .Nm .
 .Sh SEE ALSO
 .Xr mac 4 ,
 .Xr mac_biba 4 ,
 .Xr mac_bsdextended 4 ,
 .Xr mac_ifoff 4 ,
 .Xr mac_lomac 4 ,
 .Xr mac_mls 4 ,
 .Xr mac_none 4 ,
 .Xr mac_partition 4 ,
 .Xr mac_portacl 4 ,
 .Xr mac_seeotheruids 4 ,
 .Xr mac 9
 .Sh HISTORY
 The
 .Nm
 policy module first appeared in
 .Fx 5.0
 and was developed by the
 .Tn TrustedBSD
 Project.
 .Sh AUTHORS
 This software was contributed to the
 .Fx
 Project by Network Associates Labs,
 the Security Research Division of Network Associates
 Inc.
 under DARPA/SPAWAR contract N66001-01-C-8035
 .Pq Dq CBOSS ,
 as part of the DARPA CHATS research program.
 .Sh BUGS
-See
-.Xr mac 9
-concerning appropriateness for production use.
-The
-.Tn TrustedBSD
-MAC Framework is considered experimental in
-.Fx .
-.Pp
 While the MAC Framework design is intended to support the containment of
 the root user, not all attack channels are currently protected by entry
 point checks.
 As such, MAC Framework policies should not be relied on, in isolation,
 to protect against a malicious privileged user.
Index: head/share/man/man4/procdesc.4
===================================================================
--- head/share/man/man4/procdesc.4	(revision 285872)
+++ head/share/man/man4/procdesc.4	(revision 285873)
@@ -1,91 +1,87 @@
 .\"
 .\" Copyright (c) 2013 Robert N. M. Watson
 .\" All rights reserved.
 .\"
 .\" This software was developed by SRI International and the University of
 .\" Cambridge Computer Laboratory under DARPA/AFRL contract (FA8750-10-C-0237)
 .\" ("CTSRD"), as part of the DARPA CRASH research programme.
 .\"
 .\" Redistribution and use in source and binary forms, with or without
 .\" modification, are permitted provided that the following conditions
 .\" are met:
 .\" 1. Redistributions of source code must retain the above copyright
 .\"    notice, this list of conditions and the following disclaimer.
 .\" 2. Redistributions in binary form must reproduce the above copyright
 .\"    notice, this list of conditions and the following disclaimer in the
 .\"    documentation and/or other materials provided with the distribution.
 .\"
 .\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 .\" ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
 .\" $FreeBSD$
 .\"
-.Dd August 21, 2013
+.Dd July 25, 2015
 .Dt PROCDESC 4
 .Os
 .Sh NAME
 .Nm procdesc
 .Nd process descriptor facility
 .Sh DESCRIPTION
 .Nm
 is a file-descriptor-oriented interface to process signalling and control,
 which supplements historic
 .Ux
 .Xr fork 2 ,
 .Xr kill 2 ,
 and
 .Xr wait4 2
 primitives with
 new system calls such as
 .Xr pdfork 2 ,
 .Xr pdkill 2 ,
 and
 .Xr pdwait4 2 .
 .Nm
 is designed for use with
 .Xr capsicum 4 ,
 replacing process identifiers with capability-oriented references.
 However, it can also be used independently of
 .Xr capsicum 4 ,
 displacing PIDs, which may otherwise suffer from race conditions.
 Given a process descriptor, it is possible to query its conventional PID using
 .Xr pdgetpid 2 .
 .Sh SEE ALSO
 .Xr fork 2 ,
 .Xr kill 2 ,
 .Xr pdfork 2 ,
 .Xr pdgetpid 2 ,
 .Xr pdkill 2 ,
 .Xr pdwait4 2 ,
 .Xr wait4 2 ,
 .Xr capsicum 4
 .Sh HISTORY
 .Nm
 first appeared in
 .Fx 9.0 ,
 and was developed at the University of Cambridge.
 .Sh AUTHORS
 .Nm
 was developed by
 .An -nosplit
 .An Robert Watson Aq Mt rwatson@FreeBSD.org
 and
 .An Jonathan Anderson Aq Mt jonathan@FreeBSD.org
 at the University of Cambridge, and
 .An Ben Laurie Aq Mt benl@FreeBSD.org
 and
 .An Kris Kennaway Aq Mt kris@FreeBSD.org
 at Google, Inc.
-.Sh BUGS
-.Nm
-is considered experimental in
-.Fx .
Index: head/share/man/man9/mac.9
===================================================================
--- head/share/man/man9/mac.9	(revision 285872)
+++ head/share/man/man9/mac.9	(revision 285873)
@@ -1,246 +1,231 @@
 .\"-
 .\" Copyright (c) 1999-2002 Robert N. M. Watson
 .\" Copyright (c) 2002-2004 Networks Associates Technology, Inc.
 .\" All rights reserved.
 .\"
 .\" This software was developed by Robert Watson for the TrustedBSD Project.
 .\"
 .\" This software was developed for the FreeBSD Project in part by Network
 .\" Associates Laboratories, the Security Research Division of Network
 .\" Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035
 .\" ("CBOSS"), as part of the DARPA CHATS research program.
 .\"
 .\" Redistribution and use in source and binary forms, with or without
 .\" modification, are permitted provided that the following conditions
 .\" are met:
 .\" 1. Redistributions of source code must retain the above copyright
 .\"    notice, this list of conditions and the following disclaimer.
 .\" 2. Redistributions in binary form must reproduce the above copyright
 .\"    notice, this list of conditions and the following disclaimer in the
 .\"    documentation and/or other materials provided with the distribution.
 .\"
 .\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 .\" ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
 .\" $FreeBSD$
 .\"
-.Dd July 10, 2006
+.Dd July 25, 2015
 .Dt MAC 9
 .Os
 .Sh NAME
 .Nm mac
 .Nd TrustedBSD Mandatory Access Control framework
 .Sh SYNOPSIS
 .In sys/types.h
 .In sys/mac.h
 .Pp
 In the kernel configuration file:
 .Cd "options MAC"
 .Cd "options MAC_DEBUG"
 .Sh DESCRIPTION
 .Ss Introduction
 The
 .Tn TrustedBSD
 mandatory access control framework permits dynamically
 introduced system security modules to modify system security functionality.
 This can be used to support a variety of new security services, including
 traditional labeled mandatory access control models.
 The framework provides a series of entry points which must be called by
 code supporting various kernel services, especially with respects to access
 control points and object creation.
 The framework then calls out to security modules to offer them the
 opportunity to modify security behavior at those MAC API entry points.
 Both consumers of the API (normal kernel services) and security modules
 must be aware of the semantics of the API calls, particularly with respect
 to synchronization primitives (such as locking).
-.Ss Note on Appropriateness for Production Use
-The
-.Tn TrustedBSD
-MAC Framework included in
-.Fx 5.0
-is considered experimental, and should not be deployed in production
-environments without careful consideration of the risks associated with
-the use of experimental operating system features.
 .Ss Kernel Objects Supported by the Framework
 The MAC framework manages labels on a variety of types of in-kernel
 objects, including process credentials, vnodes, devfs_dirents, mount
 points, sockets, mbufs, bpf descriptors, network interfaces, IP fragment
 queues, and pipes.
 Label data on kernel objects, represented by
 .Vt "struct label" ,
 is policy-unaware, and may be used in the manner seen fit by policy modules.
 .Ss API for Consumers
 The MAC API provides a large set of entry points, too broad to specifically
 document here.
 In general, these entry points represent an access control check or other
 MAC-relevant operations, accept one or more subjects (credentials)
 authorizing the activity, a set of objects on which the operation
 is to be performed, and a set of operation arguments providing information
 about the type of operation being requested.
 .Ss Locking for Consumers
 Consumers of the MAC API must be aware of the locking requirements for
 each API entry point: generally, appropriate locks must be held over each
 subject or object being passed into the call, so that MAC modules may
 make use of various aspects of the object for access control purposes.
 For example, vnode locks are frequently required in order that the MAC
 framework and modules may retrieve security labels and attributes from the
 vnodes for the purposes of access control.
 Similarly, the caller must be aware of the reference counting semantics
 of any subject or object passed into the MAC API: all calls require that
 a valid reference to the object be held for the duration of the
 (potentially lengthy) MAC API call.
 Under some circumstances, objects must be held in either a shared or
 exclusive manner.
 .Ss API for Module Writers
 Each module exports a structure describing the MAC API operations that
 the module chooses to implement, including initialization and destruction
 API entry points, a variety of object creation and destruction calls,
 and a large set of access control check points.
 In the future, additional audit entry points will also be present.
 Module authors may choose to only implement a subset of the entry points,
 setting API function pointers in the description structure to
 .Dv NULL ,
 permitting the framework to avoid calling into the module.
 .Ss Locking for Module Writers
 Module writers must be aware of the locking semantics of entry points
 that they implement: MAC API entry points will have specific locking
 or reference counting semantics for each argument, and modules must follow
 the locking and reference counting protocol or risk a variety of failure
 modes (including race conditions, inappropriate pointer dereferences,
 etc).
 .Pp
 MAC module writers must also be aware that MAC API entry points will
 frequently be invoked from deep in a kernel stack, and as such must be
 careful to avoid violating more global locking requirements, such as
 global lock order requirements.
 For example, it may be inappropriate to lock additional objects not
 specifically maintained and ordered by the policy module, or the
 policy module might violate a global ordering requirement relating
 to those additional objects.
 .Pp
 Finally, MAC API module implementors must be careful to avoid
 inappropriately calling back into the MAC framework: the framework
 makes use of locking to prevent inconsistencies during policy module
 attachment and detachment.
 MAC API modules should avoid producing scenarios in which deadlocks
 or inconsistencies might occur.
 .Ss Adding New MAC Entry Points
 The MAC API is intended to be easily expandable as new services are
 added to the kernel.
 In order that policies may be guaranteed the opportunity to ubiquitously
 protect system subjects and objects, it is important that kernel
 developers maintain awareness of when security checks or relevant
 subject or object operations occur in newly written or modified kernel
 code.
 New entry points must be carefully documented so as to prevent any
 confusion regarding lock orders and semantics.
 Introducing new entry points requires four distinct pieces of work:
 introducing new MAC API entries reflecting the operation arguments,
 scattering these MAC API entry points throughout the new or modified
 kernel service, extending the front-end implementation of the MAC API
 framework, and modifying appropriate modules to take advantage of
 the new entry points so that they may consistently enforce their
 policies.
 .Sh ENTRY POINTS
 System service and module authors should reference the
 .%T "FreeBSD Architecture Handbook"
 for information on the MAC Framework APIs.
 .Sh SEE ALSO
 .Xr acl 3 ,
 .Xr mac 3 ,
 .Xr posix1e 3 ,
 .Xr mac_biba 4 ,
 .Xr mac_bsdextended 4 ,
 .Xr mac_ifoff 4 ,
 .Xr mac_lomac 4 ,
 .Xr mac_mls 4 ,
 .Xr mac_none 4 ,
 .Xr mac_partition 4 ,
 .Xr mac_seeotheruids 4 ,
 .Xr mac_test 4 ,
 .Xr ucred 9 ,
 .Xr vaccess 9 ,
 .Xr vaccess_acl_posix1e 9 ,
 .Xr VFS 9
 .Rs
 .%T "The FreeBSD Architecture Handbook"
 .%U "http://www.FreeBSD.org/doc/en_US.ISO8859-1/books/arch-handbook/"
 .Re
 .Sh HISTORY
 The
 .Tn TrustedBSD
 MAC Framework first appeared in
 .Fx 5.0 .
 .Sh AUTHORS
 This manual page was written by
 .An Robert Watson .
 This software was contributed to the
 .Fx
 Project by Network Associates Laboratories, the Security Research
 Division of Network Associates Inc.\& under DARPA/SPAWAR contract
 N66001-01-C-8035
 .Pq Dq CBOSS ,
 as part of the DARPA CHATS research program.
 .Pp
 .An -nosplit
 The
 .Tn TrustedBSD
 MAC Framework was designed by
 .An Robert Watson ,
 and implemented by the Network Associates Laboratories Network Security
 (NETSEC), Secure Execution Environment (SEE), and Adaptive
 Network Defense research groups.
 Network Associates Laboratory staff contributing to the CBOSS Project
 include (in alphabetical order):
 .An Lee Badger ,
 .An Brian Feldman ,
 .An Hrishikesh Dandekar ,
 .An Tim Fraser ,
 .An Doug Kilpatrick ,
 .An Suresh Krishnaswamy ,
 .An Adam Migus ,
 .An Wayne Morrison ,
 .An Andrew Reisse ,
 .An Chris Vance ,
 and
 .An Robert Watson .
 .Pp
 Sub-contracted staff include:
 .An Chris Costello ,
 .An Poul-Henning Kamp ,
 .An Jonathan Lemon ,
 .An Kirk McKusick ,
 .An Dag-Erling Sm\(/orgrav .
 .Pp
 Additional contributors include:
 .An Pawel Dawidek ,
 .An Chris Faulhaber ,
 .An Ilmar Habibulin ,
 .An Mike Halderman ,
 .An Bosko Milekic ,
 .An Thomas Moestl ,
 .An Andrew Reiter ,
 and
 .An Tim Robbins .
 .Sh BUGS
-See the earlier section in this document concerning appropriateness
-for production use.
-The
-.Tn TrustedBSD
-MAC Framework is considered experimental in
-.Fx .
-.Pp
 While the MAC Framework design is intended to support the containment of
 the root user, not all attack channels are currently protected by entry
 point checks.
 As such, MAC Framework policies should not be relied on, in isolation,
 to protect against a malicious privileged user.