MAC_DDB(4)

📦 version 15.1, in freebsd 14.5, freebsd 15.1, nixpkgs unstable

💻 MAC_DDB(4) 💻

okay so bestie, this page comes from the Kernel Interfaces Manual and it’s all about mac_ddb, the Restricted kernel debugger interface policy. yes, we’re getting into kernel debugger safety vibes today 💅

✨ NAME ✨

  • mac_ddb — Restricted kernel debugger interface policy

🌸 SYNOPSIS 🌸

So you wanna compile the ddb policy into your kernel? iconic. put these lines in your kernel configuration file, fr fr:

options MAC
options MAC_DDB

Alternately, if you wanna load the ddb module at boot time instead, put this line in your kernel configuration file:

options MAC

and then in loader.conf(5):

mac_ddb_load="YES"

slay, that’s the whole setup 🎀

🦋 DESCRIPTION 🦋

The mac_ddb policy module implements a MAC policy that restricts the set of commands you can use at the ddb(4) command prompt. the subset of permitted commands is limited to those which do not read or write to arbitrary memory locations. this is done to deter the possible extraction of system secrets while still allowing enough debugger functionality to diagnose a kernel panic. for example, the trace or show registers commands are allowed by this policy, but show buffer addr is not. that’s the vibe check 🔥

All debugger commands that are declared with the DB_CMD_MEMSAFE flag are allowed by mac_ddb. the policy also provides validation functions to conditionally allow some additional commands, based on the user provided arguments — so it’s not just a total no-fun zone, it’s a conditional no-fun zone 😭

When loaded, the mac_ddb policy also ensures that only the ddb(4) debugger backend may be executed; gdb(4) may not. periodt 💀

🎀 Label Format 🎀

No labels are defined for mac_ddb. like, none. zero. nada. the label shelf is empty bestie 🙈

🌈 SEE ALSO 🌈

💀 BUGS 💀

While the MAC Framework design is intended to support the containment of the root user, not all attack channels are currently protected by entry point checks. As such, MAC Framework policies should not be relied on, in isolation, to protect against a malicious privileged user.

so yeah, bestie — do not treat this policy like a solo main character when it comes to stopping a malicious privileged user. it’s giving “important layer,” not “the entire defense.” noted, fr fr 🫶

xoxo, your Debian bestie 💖 — June 29, 2022 — MAC_DDB(4) 🎀

📦 where this page comes from