Every module included with the MAC framework may be
either compiled into the kernel as noted above or loaded as a run-time kernel module. The
recommended method is to add the module name to the /boot/loader.conf file so that it will load during the initial boot
operation.
The following sections will discuss the various MAC
modules and cover their features. Implementing them into a specific environment will also
be a consideration of this chapter. Some modules support the use of labeling, which is
controlling access by enforcing a label such as “this is allowed and this is
not”. A label configuration file may control how files may be accessed, network
communication can be exchanged, and more. The previous section showed how the multilabel flag could be set on file systems to enable per-file or
per-partition access control.
A single label configuration would enforce only one label across the system, that is
why the tunefs option is called multilabel.
