MAC_BSDEXTENDED(4)

💖 mac_bsdextended(4) — the file system firewall policy 💖

okay bestie, gather round, because this one is literally a firewall but for files, and it's iconic. welcome to mac_bsdextended(4), the mandatory access control module that goes "no ma'am" to specific users touching specific things. let's get into it 🎀

---

✨ NAME ✨

mac_bsdextended — file system firewall policy 🦋

---

✨ SYNOPSIS ✨

so there's two ways to get this bad boy living in your kernel, and you gotta pick your fighter 💅

Option 1: compile it in. drop these lines into your kernel config file:

options MAC
options MAC_BSDEXTENDED

Option 2: load the module at boot time instead. then you only need this in your kernel config file:

options MAC

aaaand then over in loader.conf(5) you add:

mac_bsdextended_load="YES"

slay, that's it, no cap ✨

---

✨ DESCRIPTION ✨

the mac_bsdextended security policy module is basically a whole interface for the system administrator to lay down mandatory rules about users and, like, some system objects. you upload rules to the module — usually with ugidfw(8), or honestly whatever other tool is vibing with libugidfw(3) — and the module keeps them stored internally, then uses them to decide whether to allow or deny specific accesses. (go peek at ugidfw(8) for the deets, bestie.)

---

✨ IMPLEMENTATION NOTES ✨

okay so here's the tea: even though the traditional mac(9) entry points are implemented, policy labels are not used. instead, access control decisions happen by iterating through the internal list of rules until it finds a rule that denies that particular access — or until it just runs out of list. 💀

the mac_bsdextended policy works kinda like ipfw(8), or, if you prefer, it uses a first match semantic. what that means fr fr is that not all rules get applied — only the first matched rule does. so if Rule A allows access and Rule B blocks access, Rule B will never be applied. periodt. 👑

🫶 Sysctls 🫶

these sysctls are your little knobs for tweaking how mac_bsdextended behaves:

• security.mac.bsdextended.enabled — set it to zero or one to toggle the policy off or on.
• security.mac.bsdextended.rule_count — lists the number of defined rules; the maximum rule count is currently set at 256.
• security.mac.bsdextended.rule_slots — lists the number of rule slots currently being used.
• security.mac.bsdextended.firstmatch_enabled — toggles between the old all-rules-match functionality and the new first-rule-matches functionality. this one is enabled by default.
• security.mac.bsdextended.logging — logs all access violations via the AUTHPRIV syslog(3) facility.
• security.mac.bsdextended.rules — currently does nothing interesting. 🙈 (iconic honestly, it's just there, existing, main character energy with no plot)

---

✨ SEE ALSO ✨

go read these next, they're all part of the cinematic universe 🌈

libugidfw(3), syslog(3), mac(4), mac_biba(4), mac_ifoff(4), mac_lomac(4), mac_mls(4), mac_none(4), mac_partition(4), mac_portacl(4), mac_seeotheruids(4), mac_test(4), ipfw(8), ugidfw(8), mac(9)

---

✨ HISTORY ✨

the mac_bsdextended policy module first appeared in FreeBSD 5.0, and it was developed by the TrustedBSD Project. 🎀

the "match first case" and logging capabilities were later added by Tom Rhodes <trhodes@FreeBSD.org>. 💜

---

✨ AUTHORS ✨

this software was contributed to the FreeBSD Project by NAI Labs, the Security Research Division of Network Associates Inc., under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA CHATS research program. 🫡

---

and that's the whole page, bestie!! this one came from the Debian corner of the universe, dated May 21, 2005 — vintage but still eating 💅✨ mwah, go firewall some files 🦋💖