MAC_IPACL(4)

💅 MAC_IPACL(4) — the mac_ipacl manual, bestie edition ✨

okay so welcome to mac_ipacl(4), from the Kernel Interfaces Manual 🎀 this is the IP Address access control policy page and honestly? it's giving gatekeeper-but-make-it-kerneL. let's get into it 🦋

---

✨ NAME ✨

mac_ipacl — the IP Address access control policy, aka the bouncer at the club for your jails' IPs 👑

---

🌸 SYNOPSIS 🌸

so to compile the IP address access control policy into your kernel, you literally just drop these lines into your kernel configuration file:

options MAC
options MAC_IPACL

and if you'd rather load the mac_ipacl policy module at boot time instead, add this one in your kernel configuration file:

options MAC

and then in loader.conf(5) you add:

mac_ipacl_load="YES"

no cap, that's the whole vibe check 💖

---

🦋 DESCRIPTION 🦋

the mac_ipacl policy lets the root of the host use the sysctl(8) interface to limit the VNET(9) jail's ability to set IPv4 and IPv6 addresses 🫶 so basically the host gets to define rules for jails and their interfaces, all about IP addresses, using sysctl(8) MIBs. main character energy, honestly.

its default behavior is to deny all IP addresses for the jail if the mac_ipacl policy is enforced 😭 and then it'll allow/deny IP (or subnets) according to the security.mac.ipacl.rules string you specify with sysctl(8).

🎀 Runtime Configuration 🎀

these sysctl(8) MIBs are the ones that control enforcement and behavior of this MAC Policy. periodt.

• security.mac.ipacl.ipv4 — enforces mac_ipacl for IPv4 addresses. (Default: 1). 🍓
• security.mac.ipacl.ipv6 — enforces mac_ipacl for IPv6 addresses. (Default: 1). 🍓
• security.mac.ipacl.rules — the IP address access control list, and it's specified in this format:

jid,allow,interface,addr_family,IP_addr/prefix[@jid,...]

and here's what each little piece means, iykyk:

• jid — describes the jail id of the jail this rule is written for. 🧚
• allow — 1 for allow and 0 for deny. decides the action performed for the rule. slay or nay 💀
• interface — the name of the interface the rule is enforced for. if the interface is left empty then it's a wildcard to enforce the rule for all interfaces ✨
• addr_family — the address family of the IP_addr. the input has to be given as the AF_INET or AF_INET6 string only, no improvising 🙈
• IP_addr — the IP address (or subnet) to be allowed/denied. the action depends on the prefix length.
• prefix — the prefix length of the subnet to be enforced by the policy. -1 implies the policy is enforced for the individual IP address. for a non-negative value, it's a range of IP addresses (present in the subnet) which is calculated as subnet = IP_addr & mask. math but make it fashion 💅

---

🔥 EXAMPLES 🔥

behavior of the mac_ipacl policy module for different inputs of the sysctl variable, coming right up:

1. assign ipv4=1, ipv6=0 and rules="1,1,,AF_INET,169.254.123.123/-1"

it allows only 169.254.123.123 IPv4 address for all interfaces (wildcard) of jail 1. it allows all IPv6 addresses since the policy is not enforced for IPv6. iconic.

2. assign ipv4=1, ipv6=1 and rules="1,1,epair0b,AF_INET6,fe80::/32@1,0,epair0b,AF_INET6,fe80::abcd/-1"

it denies all IPv4 addresses because the policy is enforced but no rules are specified about it 😭 it allows all IPv6 addresses in subnet fe80::/32 except fe80::abcd for interface epair0b only. very specific, very demure.

3. assign ipv4=1, ipv6=1, rules="2,1,,AF_INET6,fc00::/7@2,0,,AF_INET6,fc00::1111:2200/120@2,1,,AF_INET6,fc00::1111:2299/-1@1,1,,AF_INET,198.51.100.0/24"

it allows IPv4 in subnet 198.51.100.0/24 for jail 2 and all interfaces 🌈 it allows IPv6 addresses in subnet fc00::/7 but denies subnet fc00::1111:2200/120, and allows the individual IP fc00::1111:2299 from the denied subnet for all interfaces in jail 2. the way that rule just carves out an exception? obsessed. 💜

please refer to mac/ipacl tests-framework for a wide variety of examples on using the ipacl module 🫶

---

🎀 LIMITATIONS/PRECAUTIONS 🎀

in the case where multiple rules are applicable to an IP address or a set of IP addresses, the rule that is defined later in the list determines the outcome, disregarding any previous rule for that IP address. so like, last one wins, no take-backs, the earlier rules simply do not get a say 😤

---

⭐ FUTURE WORKS ⭐

rules are given with the sysctl interface which gets very complex to give them all in command line 😭 it has to be simplified with a better way to input those rules. manifesting it fr fr 🙏

---

💖 SEE ALSO 💖

• mac(4)
• mac(9)

---

👑 AUTHORS 👑

the mac_ipacl policy module was developed as a Google Summer of Code Project in 2019 by Shivank Garg <shivank@FreeBSD.org> under the guidance of Bjoern A. Zeeb <bz@FreeBSD.org>. we stan a GSoC king 🎓✨

---

okay that's the whole page bestie, go forth and rule your jails 🧚💫

— with love from the Debian edition, dated July 25, 2023, signing off 🎀 MAC_IPACL(4) forever 💅