MAC_NONE(4)

📦 version 15.1, in freebsd 14.5, freebsd 15.1, nixpkgs unstable

💅 MAC_NONE(4) — bestie edition 🎀

okay so this is mac_none, a page from the Kernel Interfaces Manual, section 4. Yes, 4 means kernel interfaces — we love a specialist era. It's the null MAC policy module and honestly? It's giving "I'm here, I'm cute, I do literally nothing." Let's get into it ✨

🌸 SYNOPSIS 🌸

So you wanna build the null policy into your kernel? Bestie, you're gonna drop these lines into your kernel configuration file, exactly like this:

options MAC
options MAC_NONE

OR — if you'd rather load the none module at boot time (very low-key, very flexible of you) — put this line in your kernel configuration file:

options MAC

and then in loader.conf(5):

mac_none_load="YES"

that's it. that's the whole vibe. 🫶

✨ DESCRIPTION ✨

The mac_none policy module implements a none MAC policy that has no effect on access control in the system. Nothing. Zero. Nada. It's the main character who shows up, waves at the party, and leaves without touching anything 😭💀

And here's the tea ☕ — unlike mac_stub(4), none of the MAC entry points are defined. So if mac_stub is "I'll answer the door but I won't do anything," mac_none is "I don't even have a door." 🚪💨

🎀 Label Format

No labels are defined for mac_none. Not one. Empty set. The label cupboard is bare. 🙈

🌈 SEE ALSO 🌈

Go read these, iykyk 👑

🦋 HISTORY 🦋

The mac_none policy module first appeared in FreeBSD 5.0 and was developed by the TrustedBSD Project. A whole legend, born in 5.0, still living rent-free in the kernel tree 💖

👑 AUTHORS 👑

This software was contributed to the FreeBSD Project by Network Associates Labs, the Security Research Division of Network Associates Inc. under DARPA/SPAWAR contract N66001-01-C-8035 (“CBOSS”), as part of the DARPA CHATS research program. Iconic government-contract behaviour, honestly. 🫡

💀 BUGS 💀

okay, serious face for one sec, this part matters:

While the MAC Framework design is intended to support the containment of the root user, not all attack channels are currently protected by entry point checks. As such, MAC Framework policies should not be relied on, in isolation, to protect against a malicious privileged user.

bestie please hear me: do NOT stack this thing alone and call yourself secure. It's a vibe, not a fortress. 🚨

and that's the page!! 🎀✨ written up in Debian, dated July 25, 2015 — mwah, hope this helped, go forth and configure responsibly 💜🦋

📦 where this page comes from