From: Casey Schaufler <casey@schaufler-ca.com>
Smack is the Simplified Mandatory Access Control Kernel.
Smack implements mandatory access control (MAC) using labels

attached to tasks and data containers, including files, SVIPC,

and other tasks. Smack is a kernel based scheme that requires

an absolute minimum of application support and a very small

amount of configuration data.
Smack uses extended attributes and

provides a set of general mount options, borrowing technics used

elsewhere. Smack uses netlabel for CIPSO labeling. Smack provides

a pseudo-filesystem smackfs that is used for manipulation of

system Smack attributes.
The patch, patches for ls and sshd, a README, a startup script,

and x86 binaries for ls and sshd are also available on
    http://www.schaufler-ca.com
The patch has been tested with 2.6.22, 2.6.23-rc8,

2.6.23-rc8-mm2, and 2.6.22-rc9. Development has been done

using Fedora Core 7 in a virtual machine environment and on

an old Sony laptop.
Smack provides mandatory access controls based on the label attached

to a task and the label attached to the object it is attempting to

access. Smack labels are deliberately short (1-23 characters) text

strings. Single character labels using special characters are reserved

for system use. The only operation applied to Smack labels is equality

comparison. No wildcards or expressions, regular or otherwise, are

used. Smack labels are composed of printable characters and may not

include "/".
A file always gets the Smack label of the task that created it.
Smack defines and uses these labels:
    "*" - pronounced "star"

    "_" - pronounced "floor"

    "^" - pronounced "hat"

    "?" - pronounced "huh"
The access rules enforced by Smack are, in order:
1. Any access requested by a task labeled "*" is denied.

2. A read or execute access requested by a task labeled "^"

   is permitted.

3. A read or execute access requested on an object labeled "_"

   is permitted.

4. Any access requested on an object...
[ message continues ]