Label-based mandatory access control using extended attributes. Supports UFS (with multilabel) and ZFS.

# Build
cd kernel && make SYSDIR=/usr/src/sys
cd tools && make

# Load and label
kldload ./kernel/mac_abac.ko
mac_abac_ctl label set /usr/local/bin/myapp "type=trusted,domain=web"

# Add rules and enforce
mac_abac_ctl rule add "deny exec * -> type=untrusted"
sysctl security.mac.mac_abac.mode=2

• Admin Guide - Sysctls, syscalls, ZFS/UFS behavior, security
• Labels - Label format, extended attributes
• Policy - Writing rules
• Examples - Real-world scenarios
• Architecture - System design, DTrace probes
• Tools - mac_abac_ctl and mac_abacd usage

There are two ways to load the kernel module:

# Copy module to VM and load manually
scp kernel/mac_abac.ko root@vm:/root/
ssh root@vm 'kldload /root/mac_abac.ko'

Module is loaded once; lost on reboot. Good for quick testing.

# Install to boot kernel directory (preferred location)
scp kernel/mac_abac.ko root@vm:/boot/kernel/

# Enable in loader.conf (on the VM)
echo 'mac_abac_load="YES"' >> /boot/loader.conf

Module loads automatically at boot, before userland starts. This is the recommended setup for test VMs.

Important: FreeBSD searches /boot/kernel/ before /boot/modules/. Check where your module loads from:

kldstat -v | grep mac_abac
# Output shows: (/boot/kernel/mac_abac.ko) or (/boot/modules/mac_abac.ko)

If you have copies in multiple locations, the kernel uses this search order:

1. /boot/kernel/ (base system modules)
2. /boot/modules/ (third-party modules)

Always update the copy that's actually being loaded.

The module cannot be unloaded (by design - orphaned labels would crash the kernel). To update:

1. Find where the module is loaded from:

   ssh root@vm 'kldstat -v | grep mac_abac'
   # Shows: (/boot/kernel/mac_abac.ko) or similar

2. Copy new .ko to that exact location:

   scp kernel/mac_abac.ko root@vm:/boot/kernel/   # or wherever kldstat showed

3. Reboot the system:

   ssh root@vm reboot

Troubleshooting: If debug spam persists after reboot, verify the correct file was updated:

# Check MD5 matches between local and VM
md5sum kernel/mac_abac.ko                           # local
ssh root@vm 'md5 /boot/kernel/mac_abac.ko'          # VM - must match!

# Find all copies on VM
ssh root@vm 'find / -name mac_abac.ko 2>/dev/null'

# Release build (no console spam)
make SYSDIR=/usr/src/sys

# Debug build (verbose logging to console)
make SYSDIR=/usr/src/sys ABAC_DEBUG=1

• No module unload - Reboot to update module (see above).
• Use mac_abac_ctl, not getfmac/setfmac (standard MAC tools don't work with our label format).

• FreeBSD 15.0+
• options MAC in kernel
• UFS with multilabel mount option, or ZFS

See Admin Guide for detailed behavior differences and security considerations.

For bulk binary labeling, see maclabel in FreeBSDKit (Sources/mac-policy-cli). It reads JSON configuration files and applies labels recursively to directories, with Capsicum sandboxing.

BSD-2-Clause