MAC.CONF(5)

💅 mac.conf — bestie edition ✨

okay so you found the mac.conf(5) page, the File Formats Manual one — welcome to the format of the MAC library configuration file 🎀 and honestly? it's giving "small file, big job" and i'm obsessed.

---

🌸 NAME 🌸

mac.conf — the format of the MAC library configuration file. that's the whole vibe, that's the main character energy ✨

---

🦋 DESCRIPTION 🦋

okay so picture this: mac.conf is the file that configures the default label elements used by policy-agnostic applications that operate on MAC labels. fr fr, that's literally its job 💅

inside you'll find a series of default label sets specified by object class, plus blank lines, plus comments — and comments are the ones preceded by a # symbol, iykwyk 🎀

now, currently the implementation supports two syntax styles for label element declaration, and you need to know both because one of them is lowkey deprecated 😭

• the old (deprecated) syntax — a single line with two fields separated by white space: the object class name, and a list of label elements as used by the mac_prepare(3) library calls prior to an application invocation of a function from mac_get(3). she's iconic but she's deprecated, we still respect her tho 🫶
• the newer, more preferred syntax — three fields separated by white space: the label group, the object class name, and a list of label elements. this is the one you should be using, bestie, no cap ⭐

and here's a cute little detail: label element names may optionally begin with a ? symbol. what does that do? it indicates that a failure to retrieve the label element for an object should be silently ignored, and it improves usability if the set of MAC policies may change over time 🌈 honestly the ? is doing so much heavy lifting and nobody thanks her 💀

---

🧚 FILES 🧚

• /etc/mac.conf — the MAC library configuration file. that's the one, that's the girl 🎀

---

🔥 EXAMPLES 🔥

okay so here's the example, and it configures user applications to operate with four MAC policies: mac_biba(4), mac_mls(4), SEBSD, and mac_partition(4). look at her go 👑

#
# Default label set to be used by simple MAC applications

default_labels file ?biba,?lomac,?mls,?sebsd
default_labels ifnet ?biba,?lomac,?mls,?sebsd
default_labels process ?biba,?lomac,?mls,?partition,?sebsd
default_labels socket ?biba,?lomac,?mls

#
# Deprecated (old) syntax

default_file_labels ?biba,?mls,?sebsd
default_ifnet_labels ?biba,?mls,?sebsd
default_process_labels ?biba,?mls,partition,?sebsd

so what's actually happening here? in this example, userland applications will attempt to retrieve Biba, MLS, and SEBSD labels for all object classes; and for processes, they will additionally attempt to retrieve a Partition identifier 🦋

and in all cases except the Partition identifier, failure to retrieve a label due to the respective policy not being present will be ignored — that's the ? doing her thing, silently, gracefully, iconically 💅✨

---

💜 SEE ALSO 💜

mac(3), mac_get(3), mac_prepare(3), mac(4), mac(9) — go read them, bestie, they're the supporting cast and they ate 🫶

---

👑 HISTORY 👑

support for Mandatory Access Control was introduced in FreeBSD 5.0 as part of the TrustedBSD Project 🌟 a classic, a legend, we stan 🎀

---

💖 and that's the whole page, bestie! go forth and configure your default label sets with confidence. you got this. periodt. 💅

---

Debian · July 25, 2015 · MAC.CONF(5) — mwah, that's the source, version and date doing their little sign-off 🎀💋✨