MAC_SEEOTHERUIDS(4)

🎀 MAC_SEEOTHERUIDS(4) 🎀

okay so bestie, we're in the Kernel Interfaces Manual today and the star of the show is mac_seeotheruids — a whole module whose entire personality is deciding whether users get to see other users. yeah. that's it. that's the vibe. 💅

---

✨ NAME ✨

mac_seeotheruids — the simple policy that controls whether users see other users 🫶

---

🌸 SYNOPSIS 🌸

so there are two ways to get this baby in your life, and I need you to pick one, not both, mwah 💖

Way 1: compile it into your kernel. put these lines in your kernel configuration file:

options MAC
options MAC_SEEOTHERUIDS

Way 2: load the module at boot time instead. put this line in your kernel configuration file:

options MAC

and then in loader.conf(5):

mac_seeotheruids_load="YES"

like. look at that. two lines and a dream. slay ⭐

---

🦋 DESCRIPTION 🦋

the mac_seeotheruids policy module, when it's enabled, denies users the ability to see processes or sockets owned by other users. periodt. that's the whole assignment. 👑

to enable mac_seeotheruids, set the sysctl OID security.mac.seeotheruids.enabled to 1. 🎀

to let the superuser be aware of other credentials by virtue of privilege, set the sysctl OID security.mac.seeotheruids.suser_privileged to 1.

to allow users to see processes and sockets owned by the same primary group, set the sysctl OID security.mac.seeotheruids.primarygroup_enabled to 1. group chat energy, honestly 🫶

to allow processes with a specific group ID to be exempt from the policy, set the sysctl OID security.mac.seeotheruids.specificgid_enabled to 1, and set security.mac.seeotheruids.specificgid to the list of group IDs to be exempted. exemptions!! we love a VIP list 💅

🌈 Label Format

not a single label is defined for mac_seeotheruids. that's right, bestie — no labels. none. the void. 😭

---

🔥 SEE ALSO 🔥

the whole friend group showed up, iykyk:

• mac(4)
• mac_biba(4)
• mac_bsdextended(4)
• mac_ddb(4)
• mac_ifoff(4)
• mac_lomac(4)
• mac_mls(4)
• mac_none(4)
• mac_partition(4)
• mac_portacl(4)
• mac_test(4)
• mac(9)

---

⭐ HISTORY ⭐

the mac_seeotheruids policy module first appeared in FreeBSD 5.0 and was developed by the TrustedBSD Project. a little legend behavior, ngl 🧚

---

💜 AUTHORS 💜

this software was contributed to the FreeBSD Project by Network Associates Labs, the Security Research Division of Network Associates Inc. under DARPA/SPAWAR contract N66001-01-C-8035 (“CBOSS”), as part of the DARPA CHATS research program. iconic paperwork moment, genuinely 👑

---

💀 BUGS 💀

okay listen, the important part. while the MAC Framework design is intended to support the containment of the root user, not all attack channels are currently protected by entry point checks. as such, MAC Framework policies should not be relied on, in isolation, to protect against a malicious privileged user. fr fr, do not use this alone and call it a day 🙈

---

kisses, the mac_seeotheruids(4) girlie 💖 — page courtesy of Debian, dated Februrary 26, 2026 (yes, spelled exactly like that, no cap 🎀)