MAC_STUB(4)

📦 version 12.2, in debian bookworm, debian trixie, ubuntu jammy, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

💖 MAC_STUB(4) 💖

okay bestie, welcome to the Kernel Interfaces Manual, and today's main character is mac_stub — the MAC policy stub module. yes it's a stub. yes it's still iconic. let's get into it 🦋

✨ NAME ✨

mac_stub — the MAC policy stub module, no cap

✨ SYNOPSIS ✨

so there are two whole ways to get this vibe going, and you gotta pick one, okay?

Option A: compile it right into your kernel. drop these lines in your kernel configuration file:

options MAC
options MAC_STUB

Option B: load the stub module at boot time instead. for that one, put this line in your kernel configuration file:

options MAC

and then in loader.conf(5):

mac_stub_load="YES"

like, that's it. that's the whole thing. 💅

✨ DESCRIPTION ✨

okay so here's the tea 🍵 — the mac_stub policy module implements a stub MAC policy that has no effect on access control in the system. literally zero effect. it's giving decorative.

and here's the part that makes it different from mac_none(4): with mac_stub, every single MAC entry point is defined as a "no-op". so like, the policy module will get entered for each event — it shows up, it's in the room, it's attending — but no change in system behavior should result. main character energy, zero plot impact. 🙈

🌸 Label Format 🌸

No labels are defined for mac_stub.

that's it. that's the label format section. it's empty. it's minimal. it's honestly a mood. ✨

✨ SEE ALSO ✨

go read these next bestie, they're all part of the family:

✨ HISTORY ✨

The mac_stub policy module first appeared in FreeBSD 5.1 and was developed by the TrustedBSD Project. so it's been around. it's a legacy icon fr fr. 👑

✨ AUTHORS ✨

This software was contributed to the FreeBSD Project by Network Associates Labs, the Security Research Division of Network Associates Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA CHATS research program. shoutout to the researchers, they ate. 🫶

✨ BUGS ✨

okay bestie this is the serious part, so listen up 🚨

While the MAC Framework design is intended to support the containment of the root user, not all attack channels are currently protected by entry point checks.

As such, MAC Framework policies should not be relied on, in isolation, to protect against a malicious privileged user. like, do not. i'm begging. do not. 😭

and that's the whole page! this one was brought to you from the Debian side of things, dated July 25, 2015 — so yeah, it's vintage, it's a classic, it's still serving. hope this helped bestie, now go read your kernel config 💖🎀🦋

📦 where this page comes from