This is an old revision of the document!

The MAC (Mandatory Access Control) framework provides an intuitive API to managing access control to kernel-level sub-system logic. Through the use of MAC entry points littered through-out the system, composition of kernel security logic may be modified and/or monitored through MAC modules. The MAC framework also facilitates inter-communication between MAC modules and the rest of the system (including user-space) through MAC labels (covering file descriptors to individual mbuf's) and other entry points (such as mac_syscall, a multiplexed system call of sorts). More information can be found in the [http://www.freebsd.org/doc/en_US.ISO8859-1/books/arch-handbook/mac.html FreeBSD Architecture Handbook].