MAC_TEST(4)

📦 version 12.2, in debian bookworm, debian trixie, ubuntu jammy, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

💖 MAC_TEST(4) 💖

okay bestie, welcome to MAC_TEST — the MAC framework's testing policy, straight out of the Kernel Interfaces Manual. yes it's a whole manual page and yes we're gonna get through it together 🫶

✨ NAME ✨

mac_test — the MAC framework testing policy 🧪

🌸 SYNOPSIS 🌸

so like, if you wanna compile the testing policy into your kernel, you drop these lines into your kernel configuration file:

options MAC
options MAC_TEST

or — alternate route, bestie — if you'd rather load the testing module at boot time, you put this in your kernel configuration file:

options MAC

and then in loader.conf(5):

mac_test_load="YES"

see how options MAC shows up in both? that's not a typo, that's the vibe. MAC is the main character, MAC_TEST is the guest star 💅

🦋 DESCRIPTION 🦋

okay so the mac_test policy module implements a testing facility for the MAC framework. among other things (iykyk), mac_test will try to catch corrupt labels that the system is attempting to destroy and drop to the debugger. dramatic? yes. necessary? also yes.

and on top of that, there's a whole set of statistics about how many times various MAC framework entry points have been called, and it all lives in the security.mac.test sysctl(8) tree. stats girlies stay winning 📊✨

🎀 Label Format 🎀

no labels are defined for mac_test. that's it. that's the whole section. nothing. zero. the void. 💀

👑 SEE ALSO 👑

go read these too, fr fr:

⭐ HISTORY ⭐

the mac_test policy module first appeared in FreeBSD 5.0 and was developed by the TrustedBSD Project. iconic behavior since day one 🫶

💜 AUTHORS 💜

this software was contributed to the FreeBSD Project by Network Associates Labs, the Security Research Division of Network Associates Inc. under DARPA/SPAWAR contract N66001-01-C-8035 (“CBOSS”), as part of the DARPA CHATS research program. shoutout to the researchers, no cap 🎓✨

😭 BUGS 😭

okay this is the part where we get serious for a sec, bestie, because it matters:

while the MAC Framework design is intended to support the containment of the root user, not all attack channels are currently protected by entry point checks. as such, MAC Framework policies should not be relied on, in isolation, to protect against a malicious privileged user.

like, don't run a whole security strategy off one policy and call it a day. that's not it. that's giving false confidence. 🙈

and that's the page!! this was the mac_test manual page from Debian, dated July 25, 2015. ty for reading, go touch some kernel config files, ily 💖🌈🎀

📦 where this page comes from