This is an old revision of the document!

The MAC (Mandatory Access Control) framework provides an intuitive API to managing access control to kernel-level sub-system logic. Through the use of MAC entry points littered through-out the system, execution of kernel access decision logic is passed to MAC modules to compose access decisions. The MAC framework also facilitates IPC between MAC modules and the rest of the system (including user-space) through MAC labels (covering file descriptors to individual mbuf's) and other entry points (such as mac_syscall, a multiplexed system call of sorts). More information can be found in the [http://www.freebsd.org/doc/en_US.ISO8859-1/books/arch-handbook/mac.html FreeBSD Architecture Handbook].