17.10. The MAC Port Access Control List Policy

Module name: mac_portacl.ko

Kernel configuration line: MAC_PORTACL

Boot option: mac_portacl_load="YES"

The mac_portacl(4) module is used to limit binding to local TCP and UDP ports using a variety of sysctl variables. mac_portacl(4) makes it possible to allow non-root users to bind to specified privileged ports below 1024.

Once loaded, this module enables the MAC policy on all sockets. The following tunables are available:


Since the ruleset is interpreted directly by the kernel, only numeric values can be used for the user ID, group ID, and port parameters. Names cannot be used for users, groups, or services.

By default, ports below 1024 can only be used by or bound to privileged processes, which run as root. For mac_portacl(4) to allow non-privileged processes to bind to ports below 1024, this restriction has to be disabled by setting the sysctl(8) variables net.inet.ip.portrange.reservedlow and net.inet.ip.portrange.reservedhigh to zero:

# sysctl security.mac.portacl.port_high=1023 # sysctl net.inet.ip.portrange.reservedlow=0 net.inet.ip.portrange.reservedhigh=0

See the examples below or refer to mac_portacl(4) for further information.

17.10.1. Examples

Since the root user should not be crippled by this policy, this example starts by setting the security.mac.portacl.suser_exempt to a non-zero value.

# sysctl security.mac.portacl.suser_exempt=1

Next, allow the user with UID 80 to bind to port 80. This allows the www user to run a web server without ever having root privilege.

# sysctl security.mac.portacl.rules=uid:80:tcp:80

The next example permits the user with the UID of 1001 to bind to the TCP ports 110 (pop3) and 995 (pop3s). This permits this user to start a server that accepts connections on ports 110 and 995.

# sysctl security.mac.portacl.rules=uid:1001:tcp:110,uid:1001:tcp:995

All FreeBSD documents are available for download at http://ftp.FreeBSD.org/pub/FreeBSD/doc/

Questions that are not answered by the documentation may be sent to <freebsd-questions@FreeBSD.org>.

Send questions about this document to <freebsd-doc@FreeBSD.org>.