MAC(4)

💖 MAC — Mandatory Access Control 💖

ok so bestie, this is mac(4), a kernel interfaces manual page, and it's literally about locking your system down. no cap. let me tell you everything. 🫶

---

✨ SYNOPSIS ✨

options MAC

that's it. that's the whole vibe. one line and you've enabled the entire framework. iconic. 👑

---

🌸 DESCRIPTION 🌸

🎀 Introduction 🎀

The Mandatory Access Control framework — MAC for short, iykyk — lets admins finely control system security by giving you a loadable security policy architecture. it's giving modular, it's giving flexible. 💅

but bestie, listen: because of its nature, MAC security policies may only restrict access relative to one another and the base system policy. they cannot override traditional Unix security provisions like file permissions and superuser checks. so like, they add rules, they don't delete the old ones. periodt.

Currently, the following MAC policy modules are shipped with FreeBSD. here's the whole lineup, no gatekeeping:

• mac_biba(4) — Biba integrity policy — labeling: yes — load time: boot only
• mac_bsdextended(4) — File system firewall — labeling: no — load time: any time
• mac_ifoff(4) — Interface silencing — labeling: no — load time: any time
• mac_lomac(4) — Low-Watermark MAC policy — labeling: yes — load time: boot only
• mac_mls(4) — Confidentiality policy — labeling: yes — load time: boot only
• mac_none(4) — Sample no-op policy — labeling: no — load time: any time
• mac_partition(4) — Process partition policy — labeling: yes — load time: any time
• mac_portacl(4) — Port bind(2) access control — labeling: no — load time: any time
• mac_seeotheruids(4) — See-other-UIDs policy — labeling: no — load time: any time
• mac_test(4) — MAC testing policy — labeling: no — load time: any time

look at that roster. main character energy from every single one. 🌈

---

🦋 MAC Labels 🦋

Every system subject (processes, sockets, etc.) and every system object (file system objects, sockets, etc.) can carry a MAC label with it. these labels contain data in an arbitrary format, and that data gets taken into consideration when making access control decisions for a given operation. 🧚

Most MAC labels on system subjects and objects can be modified directly or indirectly by the system administrator. the format for a given policy's label may vary depending on the type of object or subject being labeled. so like, it depends, bestie. 🙈

more info on the format for MAC labels lives in the maclabel(7) man page. go read it, it's right there. 💜

---

⭐ MAC Support for UFS2 File Systems ⭐

By default, file system enforcement of labeled MAC policies relies on a single file system label (peep "MAC Labels" above 👆) in order to make access control decisions for all the files in a particular file system. lowkey convenient, highkey limiting.

With some policies, this configuration may not allow administrators to take full advantage of features. 😭

In order to enable support for labeling files on an individual basis for a particular file system, the "multilabel" flag must be enabled on the file system. To set the "multilabel" flag, drop to single-user mode and unmount the file system, then execute the following command:

tunefs -l enable filesystem

where filesystem is either the mount point (in fstab(5)) or the special file (in /dev) corresponding to the file system on which to enable multilabel support. okay so don't skip that part. single-user mode first. fr fr. 🔥

---

👑 Policy Enforcement 👑

policy enforcement is divided into the following areas of the system. buckle up:

File System File system mounts, modifying directories, modifying files, etc.

KLD Loading, unloading, and retrieving statistics on loaded kernel modules

Network Network interfaces, bpf(4), packet delivery and transmission, interface configuration (ioctl(2), ifconfig(8))

Pipes Creation of and operation on pipe(2) objects

Processes Debugging (e.g. ktrace(2)), process visibility (ps(1)), process execution (execve(2)), signalling (kill(2))

Sockets Creation of and operation on socket(2) objects

System Kernel environment (kenv(1)), system accounting (acct(2)), reboot(2), settimeofday(2), swapon(2), sysctl(3), nfsd(8)-related operations

VM mmap(2)-ed files

like, every corner of the system got a vibe check. 💀

---

💅 Setting MAC Labels 💅

From the command line, each type of system object has its own means for setting and modifying its MAC policy label. here's the map:

• File system object → setfmac(8), setfsmac(8)
• Network interface → ifconfig(8)
• TTY (by login class) → login.conf(5)
• User (by login class) → login.conf(5)

Additionally, the su(1) and setpmac(8) utilities can be used to run a command with a different process label than the shell's current label. so you can like, switch up your whole identity for one command. slay. ✨

---

🌈 Programming With MAC 🌈

MAC security enforcement itself is transparent to application programs, with the exception that some programs may need to be aware of additional errno(2) returns from various system calls. so mostly you don't have to do anything, but sometimes the errno's gonna errno. 🍓

The interface for retrieving, handling, and setting policy labels is documented in the mac(3) man page.

---

💜 SEE ALSO 💜

mac(3), mac_biba(4), mac_bsdextended(4), mac_ifoff(4), mac_lomac(4), mac_mls(4), mac_none(4), mac_partition(4), mac_portacl(4), mac_seeotheruids(4), mac_test(4), login.conf(5), maclabel(7), getfmac(8), getpmac(8), setfmac(8), setpmac(8), mac(9)

"Mandatory Access Control", The FreeBSD Handbook, https://www.FreeBSD.org/doc/en_US.ISO8859-1/books/handbook/mac.html.

---

🎀 HISTORY 🎀

The mac implementation first appeared in FreeBSD 5.0 and was developed by the TrustedBSD Project. a classic. an icon. a legend. 👑

---

🌸 AUTHORS 🌸

This software was contributed to the FreeBSD Project by Network Associates Labs, the Security Research Division of Network Associates Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA CHATS research program. huge. we love a research program moment. 🫶

---

😭 BUGS 😭

While the MAC Framework design is intended to support the containment of the root user, not all attack channels are currently protected by entry point checks. As such, MAC Framework policies should not be relied on, in isolation, to protect against a malicious privileged user.

ok so read that twice bestie. it does NOT solo-carry your security. it's a team player, not a whole team. 💀

---

and that's the whole page, no crumbs left. this was the Debian build, dated July 25, 2015, filed under MAC(4). bye bestie, go enable options MAC and stay safe out there. 🦋💖✨