MAC_IFOFF(4)

📦 version 12.2, in debian bookworm, debian trixie, ubuntu jammy, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

💖 MAC_IFOFF(4) — the interface silencing policy, bestie edition 💖

okay so real talk, the manual name is MAC_IFOFF and it lives in section 4 (that's the Kernel Interfaces Manual, for the girlies keeping track) and it's literally called the interface silencing policy. yes. silencing. like when you mute the group chat but for network interfaces. iconic behavior honestly. 🎀

✨ SYNOPSIS ✨

so you wanna get this policy up in your kernel? you got two routes, bestie, and both of them start with a kernel configuration file. pick your fighter:

Route 1 — compile it straight into your kernel. drop these lines into your kernel config file:

options MAC
options MAC_IFOFF

Route 2 — load it as a module at boot time. this one's a two-parter, don't skip a step or it's giving ✨broken✨. first, in your kernel config file:

options MAC

and then in loader.conf(5):

mac_ifoff_load="YES"

slay. that's the whole vibe. 💅

🌸 DESCRIPTION 🌸

the mac_ifoff interface silencing module lets administrators (that's you, main character) turn incoming and outgoing data flow on and off on system network interfaces, all through the sysctl(8) interface. no cap. you're basically the bouncer at the club door of your own network stack. 🫶

to disable network traffic over the loopback (lo(4)) interface, set the sysctl(8) OID security.mac.ifoff.lo_enabled to 0 — and heads up, the default here is 1. so it's on unless you say otherwise. 👑

to enable network traffic over other interfaces, set the sysctl(8) OID security.mac.ifoff.other_enabled to 1 — default is 0, meaning those other interfaces are NOT passing traffic until you personally give them permission. gatekeeping, but make it kernel-level. 😭

to allow BPF traffic to be received even while all the other traffic is disabled, set the sysctl(8) OID security.mac.ifoff.bpfrecv_enabled to 1 — default is 0. it's the exception clause, the "you specifically can come in" of it all. 💖

🦋 Label Format 🦋

No labels are defined.

that's it. that's the whole section. nothing. zero. empty. and honestly? the confidence of it. 💀

🌈 SEE ALSO 🌈

the whole friend group, fr fr:

💜 HISTORY 💜

the mac_ifoff policy module first appeared in FreeBSD 5.0, and it was developed by the TrustedBSD Project. so it's not new, it's a legacy icon. respect the elders. 🧚

👑 AUTHORS 👑

this software was contributed to the FreeBSD Project by Network Associates Labs, the Security Research Division of Network Associates Inc., under DARPA/SPAWAR contract N66001-01-C-8035 (“CBOSS”), as part of the DARPA CHATS research program. government-funded research said "we're building this and it's gonna be great" and they were right. ⭐

💀 BUGS 💀

okay bestie, this part is important, so read it carefully and don't skim:

while the MAC Framework design is intended to support the containment of the root user, not all attack channels are currently protected by entry point checks. as such, MAC Framework policies should not be relied on, in isolation, to protect against a malicious privileged user.

🚨 translation: the design wants to contain root, but it can't catch everything yet. don't build your whole security story on one policy by itself. that's not a vibe, that's a vulnerability. 🚨

and that's the page, bestie. this one came from Debian, dated July 25, 2015 — so if it's aging like fine wine, that's because it is. 🍓

later, love u, go set your sysctls responsibly. 💖✨🦋🎀💅

📦 where this page comes from