MAC_PORTACL(4)

💖 MAC_PORTACL(4) — the network port access control policy 💖

okay bestie, sit down, hydrate, and let me tell you about mac_portacl(4), a kernel interfaces manual page that is genuinely iconic. it's a MAC policy. it decides who gets to grab which ports. it's giving bouncer-at-the-club energy and we're obsessed. 🎀

---

✨ NAME ✨

mac_portacl — network port access control policy

---

🌸 SYNOPSIS 🌸

so to compile the port access control policy into your kernel, you drop these lines in your kernel configuration file:

options MAC
options MAC_PORTACL

orrrrr, if you'd rather load the port access control policy module at boot time, you put this line in your kernel configuration file:

options MAC

and then this in loader.conf(5):

mac_portacl_load="YES"

pick your fighter, both are valid 💅

---

🦋 DESCRIPTION 🦋

the mac_portacl policy lets admins administratively limit binding to local UDP and TCP ports, all through the sysctl(8) interface. no cap. 🫶

for mac_portacl to even turn on, two things gotta be true:

• MAC policy must be enforced on sockets (go read mac(4), it's the prerequisite bestie)
• the port(s) you're protecting with mac_portacl must not be inside the range set by the net.inet.ip.portrange.reservedlow and net.inet.ip.portrange.reservedhigh sysctl(8) MIBs

also important: mac_portacl only cares about ports that a user process explicitly bound (whether that's a listen/outgoing TCP socket, or a send/receive UDP socket). it will not limit ports that got bound implicitly for outgoing connections where the process never picked a port itself — those get automatically selected by the IP stack, so they're not its business. 🙈

when mac_portacl is enabled, it controls binding access to ports up to the port number in the security.mac.portacl.port_high sysctl(8) variable. and by default? every attempt to bind to a mac_portacl-controlled port fails unless it's explicitly allowed by the port access control list. the one exception: binding by the superuser is allowed, as long as the sysctl(8) variable security.mac.portacl.suser_exempt is set to a non-zero value. 💀

⭐ Runtime Configuration ⭐

here's the good stuff — these sysctl(8) MIBs are how you fine-tune enforcement of this MAC policy. every single sysctl(8) variable, except security.mac.portacl.rules, can also be set as a loader(8) tunable in loader.conf(5). slay.

• security.mac.portacl.enabled — enforce the mac_portacl policy. (Default: 1).
• security.mac.portacl.port_high — the highest port number mac_portacl will enforce rules for. (Default: 1023).
• security.mac.portacl.rules — the port access control list, and it's specified in this format:

idtype:id:protocol:port[,idtype:id:protocol:port,...]

breaking that down, piece by piece, because we don't gatekeep:

• idtype — describes the type of subject match to be performed. either uid for user ID matching, or gid for group ID matching.
• id — the user or group ID (depends on idtype) allowed to bind to the specified port. NOTE: user and group names are not valid; only the actual ID numbers may be used. so don't come in here with root, bestie, use the digits. 😭
• protocol — describes which protocol this entry applies to. either tcp or udp are supported.
• port — describes which port this entry applies to. NOTE: MAC security policies may not override other security system policies by allowing accesses that they may deny, such as net.inet.ip.portrange.reservedlow / net.inet.ip.portrange.reservedhigh. if the specified port falls within the range specified, the mac_portacl entry will not function (i.e., even the specified user/group may not be able to bind to the specified port). yeah. it just won't work. that's the whole vibe.

• security.mac.portacl.suser_exempt — allow superuser (i.e., root) to bind to all mac_portacl protected ports, even if the port access control list does not explicitly allow this. (Default: 1).
• security.mac.portacl.autoport_exempt — allow applications to use automatic binding to port 0. applications use port 0 as a request for automatic port allocation when binding an IP address to a socket. this tunable will exempt port 0 allocation from rule checking. (Default: 1).

---

👑 SEE ALSO 👑

mac(3), ip(4), mac_biba(4), mac_bsdextended(4), mac_ifoff(4), mac_mls(4), mac_none(4), mac_partition(4), mac_seeotheruids(4), mac_test(4), mac(9)

the whole MAC cinematic universe, fr fr 🌈

---

🌟 HISTORY 🌟

MAC first appeared in FreeBSD 5.0, and mac_portacl first appeared in FreeBSD 5.1. little baby policy, all grown up now 🥹

---

💜 AUTHORS 💜

this software was contributed to the FreeBSD Project by NAI Labs, the Security Research Division of Network Associates Inc. under DARPA/SPAWAR contract N66001-01-C-8035 (“CBOSS”), as part of the DARPA CHATS research program. look at that résumé. main character energy. ✨

---

okay that's the whole page, bestie, you ate it. this one came out of the Debian side of the internet, dated December 9, 2004 — so yeah, it's older than most of us but it still serves 💅🦋 bye pookie, go bind responsibly! 💖