MAC_SEEOTHERUIDS(4)

📦 version 12.2, in debian bookworm, debian trixie, ubuntu jammy, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

💖 MAC_SEEOTHERUIDS(4) 💖

okay bestie, welcome to the kernel interfaces manual section, we're talking about mac_seeotheruids today and honestly? she's a vibe. sit down, grab a boba, let's get into it. 🧋

✨ NAME ✨

mac_seeotheruids — the simple policy that decides whether users get to see other users. that's it. that's the whole thing. no cap. 💅

🌸 SYNOPSIS 🌸

so there's two ways to get her in your life, and you gotta pick one, okay?

option 1: compile the policy straight into your kernel 🛠️ — drop these lines in your kernel configuration file:

options MAC
options MAC_SEEOTHERUIDS

option 2: load the module at boot time instead 🦋 — then you put this line in your kernel configuration file:

options MAC

and this in loader.conf(5):

mac_seeotheruids_load="YES"

like. pick a lane. both work. slay either way. ✨

👑 DESCRIPTION 👑

the mac_seeotheruids policy module, when enabled, denies users the ability to see processes or sockets owned by other users. it's giving "you don't know them like that." 🙈

to enable mac_seeotheruids, set the sysctl OID security.mac.seeotheruids.enabled to 1.

to permit superuser awareness of other credentials by virtue of privilege, set the sysctl OID security.mac.seeotheruids.suser_privileged to 1. yes bestie, that's the "root gets the tea" switch. 💅

to allow users to see processes and sockets owned by the same primary group, set the sysctl OID security.mac.seeotheruids.primarygroup_enabled to 1. it's giving "we're in the same group chat so we already know each other." 🫶

to allow processes with a specific group ID to be exempt from the policy, set the sysctl OID security.mac.seeotheruids.specificgid_enabled to 1, and security.mac.seeotheruids.specificgid to the group ID you wanna exempt. VIP list energy, honestly. 👑

🎀 Label Format 🎀

no labels are defined for mac_seeotheruids. that's the whole section. she's minimal, she's clean, she doesn't need labels. lowkey iconic. ✨

🌈 SEE ALSO 🌈

go read these too, they're all part of the family:

🦋 HISTORY 🦋

the mac_seeotheruids policy module first appeared in FreeBSD 5.0 and was developed by the TrustedBSD Project. she's been around, she's got lore, she's a legacy girlie fr fr. 💜

💜 AUTHORS 💜

this software was contributed to the FreeBSD Project by Network Associates Labs, the Security Research Division of Network Associates Inc., under DARPA/SPAWAR contract N66001-01-C-8035 (known as “CBOSS”), as part of the DARPA CHATS research program. shoutout to the researchers, they ate and left no crumbs. 🫶

💀 BUGS 💀

okay bestie, real talk, this is the important part so read it twice. 👀

while the MAC Framework design is intended to support the containment of the root user, not all attack channels are currently protected by entry point checks. as such, MAC Framework policies should not be relied on, in isolation, to protect against a malicious privileged user.

🚨 literally do not treat this policy like a solo bodyguard. she is not fighting a malicious root user by herself. do not rely on her in isolation. periodt. 🚨

and that's the whole page bestie!! this one came from the Debian manual, dated July 25, 2015, and honestly it still holds up. stay safe out there, keep your policies stacked, and never trust a privileged user acting sus. mwah!! 💖✨🎀🦋🌸💅

📦 where this page comes from