MAC_BSDEXTENDED(4)

💅 MAC_BSDEXTENDED(4) 💅

okay so bestie, this is the manual page for mac_bsdextended — it's a file system firewall policy, and it's genuinely iconic for keeping your system's access rules in check. iykyk.

---

✨ NAME ✨

mac_bsdextended — file system firewall policy. periodt. it's literally the bouncer for your files. 💅

---

🎀 SYNOPSIS 🎀

so if you wanna compile this policy straight into your kernel (main character energy), you drop these lines in your kernel configuration file:

options MAC
options MAC_BSDEXTENDED

or alternatively — if you're more of a "load it at boot time" vibe — put this line in your kernel configuration file:

options MAC

and then in loader.conf(5):

mac_bsdextended_load="YES"

slay. either way works. 🦋

---

🌸 DESCRIPTION 🌸

the mac_bsdextended security policy module is literally giving "interface for the system administrator to impose mandatory rules regarding users and some system objects." no cap.

rules get uploaded to the module (typically using ugidfw(8), or some other tool utilizing libugidfw(3)) — that's where they're stored internally and used to determine whether to allow or deny specific accesses (see ugidfw(8)). it's giving organized. it's giving secure. we love to see it. ✨

---

🔥 IMPLEMENTATION NOTES 🔥

okay so here's the tea — while the traditional mac(9) entry points are implemented, policy labels are not used. instead, access control decisions are made by iterating through the internal list of rules until a rule which denies the particular access is found, or the end of the list is reached.

the mac_bsdextended policy works similar to ipfw(8) or by using a first match semantic. this means that not all rules are applied, only the first matched rule. so if Rule A allows access and Rule B blocks access, Rule B will never be applied. it's giving "first come first served" but make it access control. 💀

bestie pls remember: first match wins. the rest don't even get a chance to speak. fr fr.

---

👑 SYSCTL VARIABLES 👑

the following sysctls may be used to tweak the behavior of mac_bsdextended:

• security.mac.bsdextended.enabled — set to zero or one to toggle the policy off or on. it's literally the on/off switch bestie.
• security.mac.bsdextended.rule_count — list the number of defined rules, the maximum rule count is current set at 256. that's the limit, no cap. 💀
• security.mac.bsdextended.rule_slots — list the number of rule slots currently being used. it's giving "how much of the closet is full."
• security.mac.bsdextended.firstmatch_enabled — toggle between the old all rules match functionality and the new first rule matches functionality. this is enabled by default. so yeah, first match is the vibe unless you say otherwise. ✨
• security.mac.bsdextended.logging — log all access violations via the AUTHPRIV syslog(3) facility. it's giving "snitch energy" but for security. we stan. 🙈
• security.mac.bsdextended.rules — currently does nothing interesting. literally nothing. it's giving placeholder. it's giving "we'll get to it later." 😭

---

🦋 SEE ALSO 🦋

libugidfw(3), syslog(3), mac(4), mac_biba(4), mac_ddb(4), mac_ifoff(4), mac_lomac(4), mac_mls(4), mac_none(4), mac_partition(4), mac_portacl(4), mac_seeotheruids(4), mac_test(4), ipfw(8), ugidfw(8), mac(9)

like, read them. they're all part of the family. 🫶

---

🌈 HISTORY 🌈

the mac_bsdextended policy module first appeared in FreeBSD 5.0 and was developed by the TrustedBSD Project. it's giving OG. it's giving legacy. we respect it.

the "match first case" and logging capabilities were later added by Tom Rhodes <trhodes@FreeBSD.org>. king behavior. 👑

---

💜 AUTHORS 💜

this software was contributed to the FreeBSD Project by NAI Labs, the Security Research Division of Network Associates Inc. under DARPA/SPAWAR contract N66001-01-C-8035 (“CBOSS”), as part of the DARPA CHATS research program. it's giving government-funded but make it secure. we love a collab. 🧚

---

and that's the whole vibe bestie — this page was brought to you by Debian, dated October 11, 2024. stay secure, stay slay. 💖✨🎀