MAC_STUB(4)

📦 version 15.1, in freebsd 14.5, freebsd 15.1, nixpkgs unstable

💅 MAC_STUB(4) — like, the MAC policy stub module bestie 🎀

okay so this is a page from the Kernel Interfaces Manual, and we're talking about mac_stub — the MAC policy stub module. yes that's a lot of acronyms, stay with me 💖

✨ SYNOPSIS ✨

so you wanna compile the stub policy into your kernel? bestie, drop these lines into your kernel configuration file, no cap:

options MAC
options MAC_STUB

orrr, if you'd rather load the stub module at boot time (iconic behavior honestly), put this line in your kernel configuration file:

options MAC

and then in loader.conf(5):

mac_stub_load="YES"

that's it, that's the whole vibe check 🦋

🌸 DESCRIPTION 🌸

okay so the mac_stub policy module implements a stub MAC policy that has no effect on access control in the system. literally zero effect. it's giving "I'm here but I'm not doing anything" 💀

and here's the thing — unlike mac_none(4), each MAC entry point is defined as a "no-op", so the policy module will be entered for each event, but no change in system behavior should result. so like, it shows up to the party, says hi to every entry point, and then does absolutely nothing. main character energy but make it passive 🫶

🎀 Label Format 🎀

No labels are defined for mac_stub. none. not a single one. that's the whole subsection, slay ✨

🔥 SEE ALSO 🔥

go read these too, iykyk:

💜 HISTORY 💜

The mac_stub policy module first appeared in FreeBSD 5.1 and was developed by the TrustedBSD Project. vintage. iconic. we love a origin story 👑

👑 AUTHORS 👑

This software was contributed to the FreeBSD Project by Network Associates Labs, the Security Research Division of Network Associates Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA CHATS research program. fr fr, the whole government-funded research pipeline ate 💅

💀 BUGS 💀

okay so real talk, this one matters. While the MAC Framework design is intended to support the containment of the root user, not all attack channels are currently protected by entry point checks. As such, MAC Framework policies should not be relied on, in isolation, to protect against a malicious privileged user.

like, please don't use this alone and think you're safe from a malicious root user. you're not. protect yourself bestie 🙈

and that's the whole page! 🌈 this one's from Debian, dated July 25, 2015 — ty for reading, mwah 💋⭐

📦 where this page comes from