MAC_NONE(4)

💅 mac_none — the null MAC policy module, bestie

okay so imagine a security module that literally does nothing. no thoughts, head empty, just vibes. that's her. that's mac_none. she's from the Kernel Interfaces Manual, section 4, and she is the chillest girl in the whole MAC lineup. 🦋

---

✨ SYNOPSIS ✨

so there's two ways to get her in your life, and you gotta pick one:

option one — bake her right into your kernel. drop these lines in your kernel configuration file:

options MAC
options MAC_NONE

option two — load the none module at boot time instead. for that, put this line in your kernel configuration file:

options MAC

and then over in loader.conf(5):

mac_none_load="YES"

periodt. that's the whole setup. 🎀

---

🌸 DESCRIPTION 🌸

mac_none is a policy module that implements a none MAC policy — meaning it has zero effect on access control in the system. like, none. nada. it's giving decorative.

and here's the thing that makes her different from her cousin mac_stub(4): with mac_none, none of the MAC entry points are defined at all. not one. she's not even pretending. 😭

🎀 Label Format 🎀

No labels are defined for mac_none. that's it, that's the whole section. empty. iconic. 👑

---

👀 SEE ALSO 👀

go read her sisters, they actually do stuff:

mac(4), mac_biba(4), mac_bsdextended(4), mac_ifoff(4), mac_lomac(4), mac_mls(4), mac_partition(4), mac_portacl(4), mac_seeotheruids(4), mac_stub(4), mac_test(4), mac(9)

---

📜 HISTORY 📜

The mac_none policy module first appeared in FreeBSD 5.0 and was developed by the TrustedBSD Project. so she's been doing absolutely nothing, flawlessly, since 5.0. queen behavior. 💜

---

🫶 AUTHORS 🫶

This software was contributed to the FreeBSD Project by Network Associates Labs, the Security Research Division of Network Associates Inc. under DARPA/SPAWAR contract N66001-01-C-8035 (“CBOSS”), as part of the DARPA CHATS research program. ty for your service, truly. 🫡

---

💀 BUGS 💀

okay real talk, this part actually matters, so listen up:

While the MAC Framework design is intended to support the containment of the root user, not all attack channels are currently protected by entry point checks. As such, MAC Framework policies should not be relied on, in isolation, to protect against a malicious privileged user.

translation: don't treat any MAC Framework policy — not even the ones that do things — as your only line of defense against a sketchy privileged user. they can still get in through channels nobody's checking yet. lowkey important. don't skip this one. 🙈

---

and that's the whole page, bestie! 💖 this one came to you courtesy of the Debian build, dated July 25, 2015 — she's an old soul but she still slays. MAC_NONE(4), out. 🌈⭐