POSIX1E(3)

💅 posix1e(3) — your lil intro to the POSIX.1e security API

okay so picture this: it's section 3 of the manual (the library functions zone, bestie), and this page is basically the meet the whole friend group episode for POSIX.1e security stuff. let's get into it 💖

✨ LIBRARY ✨

Standard C Library — libc, -lc. the OG, the moment, the main character of linking.

🎀 SYNOPSIS 🎀

#include <sys/types.h>
#include <sys/acl.h>
#include <sys/mac.h>

like, include these three and you're seated with the cool kids 🫶

🌸 DESCRIPTION 🌸

so POSIX.1e is out here describing five security extensions to the POSIX.1 API, and honestly it's giving a whole squad:

• Access Control Lists, aka ACLs
• Auditing
• Capabilities
• Mandatory Access Control
• Information Flow Labels

now here's the tea 🍵 the IEEE POSIX.1e D17 specification has not been standardized — nope, never made it official — but several of its interfaces are widely used anyway. queen behavior tbh.

FreeBSD implements the POSIX.1e interface for access control lists, described in acl(3), and it supports ACLs on the ffs(4) file system. but heads up — ACLs must be administratively enabled using tunefs(8). not automatic, you gotta go turn them on yourself 🙈

FreeBSD also implements a POSIX.1e-like mandatory access control interface, described in mac(3) — but with a number of extensions and important semantic differences. so like... same vibe, not identical vibes. read carefully, iykyk.

and now the sad part 😭 FreeBSD does not implement the POSIX.1e audit, privilege (capability), or information flow label APIs. RIP to those. however — it does implement the libbsm(3) audit API. and it also provides capsicum(4), a lightweight OS capability and sandbox framework implementing a hybrid capability system model. slay for that one 🔥

🦋 ENVIRONMENT 🦋

POSIX.1e assigns security attributes to all objects, extending the security functionality described in POSIX.1. these additional attributes store fine-grained discretionary access control information and mandatory access control labels. and for files? they're stored in extended attributes, described in extattr(3). literally the filing cabinet of the security world 💅

POSIX.2c then describes a set of userland utilities for manipulating these attributes, including:

• getfacl(1) and setfacl(1) for access control lists
• getfmac(8) and setfmac(8) for mandatory access control labels

get it, set it, periodt ✨

👑 SEE ALSO 👑

• getfacl(1)
• setfacl(1)
• extattr(2)
• acl(3)
• extattr(3)
• libbsm(3)
• libcasper(3)
• mac(3)
• capsicum(4)
• ffs(4)
• getfmac(8)
• setfmac(8)
• tunefs(8)
• acl(9)
• extattr(9)
• mac(9)

the whole group chat, fr fr 🫶

🌈 STANDARDS 🌈

POSIX.1e is described in IEEE POSIX.1e draft 17. that's the one. the draft. the legend. ⭐

⭐ HISTORY ⭐

POSIX.1e support was introduced in FreeBSD 4.0; most features were available as of FreeBSD 5.0. glow up timeline 💜

🧚 AUTHORS 🧚

• Robert N M Watson
• Chris D. Faulhaber
• Thomas Moestl
• Ilmar S Habibulin

icons, all of them 👑

---

💖 and that's the page, bestie 💖 this queen dropped from Debian, dated February 25, 2016 — we're talking POSIX1E(3), section 3, forever iconic. bye mwah 💋🎀