BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//2026.asiabsdcon.org//DSEXKX
BEGIN:VTIMEZONE
TZID:CST
BEGIN:STANDARD
DTSTART:20000101T000000
RRULE:FREQ=YEARLY;BYMONTH=1
TZNAME:CST
TZOFFSETFROM:+0800
TZOFFSETTO:+0800
END:STANDARD
END:VTIMEZONE
BEGIN:VEVENT
UID:pretalx-entry-DSEXKX@2026.asiabsdcon.org
DTSTART;TZID=CST:20260322T140000
DTEND;TZID=CST:20260322T144500
DESCRIPTION:In this talk\, we present the mac_do(4) and mdo(1) FreeBSD comp
 onents\, which aim at supporting a role-based security model by allowing c
 ontrolled process credentials transitions\, and do so without the use of s
 etuid executables by leveraging instead the mac(4) framework.  We describe
  their architecture and illustrate their practical functionalities to admi
 nistrators and users.\n\nThe mac_do(4) kernel module has been introduced t
 o allow unprivileged processes to change credentials\, provided the reques
 ted changes are explicitly allowed by rules set by an administrator.  Its 
 companion userland program\, mdo(1)\, serves to request credentials change
 s.\n\nBoth components have undergone major changes that have been shipped 
 into FreeBSD 15.  First\, thanks to a redesign of mac_do(4)'s rules\, it i
 s now possible to completely specify the full sets of user and group IDs t
 hat must be present or absent in the final credentials for a transition to
  be accepted.  Second\, mac_do(4)'s configuration is per jail\, allowing d
 ifferent sets of rules as needed or inheritance from the parent jail.  Thi
 s configuration can be tuned from inside and outside the jail.  Third\, md
 o(1)\, initially limited to changing users and possibly switching to their
  groups\, has grown the ability to fine-tune the target credentials' users
  and groups while retaining simplicity for the most common use cases.\n\nW
 e will describe how mac_do(4)'s credentials rules work\, what you can acco
 mplish with the mdo(1) companion program in FreeBSD 15\, and the changes t
 hat are in the works at time of this writing.  Some of them have been deve
 loped as part of Google Summer of Code 2025\, which also gave birth to the
  new mdo(1) features described above\, and are in the process of being int
 egrated\, such as per-jail configurability of "approved" companion program
 s for mac_do(4).  In general\, more logging\, auditing and ease of use fac
 ilities are to come next.  We will report on the progress of these new fea
 tures.\n\nWe will also touch on some aspects of the implementation\, notab
 ly why we needed to introduce the new setcred(2) system call\, which allow
 s to change all process credentials in a single call\, and\, time-permitti
 ng\, those that are related to the use of some FreeBSD's kernel sub-system
 s (notably\, sysctl\, jails and OSD).
DTSTAMP:20260818T170505Z
LOCATION:Room B
SUMMARY:mac_do(4)\, mdo(1) and setcred(2): Role-based credentials transitio
 ns without privileges - Olivier Certner
URL:https://2026.asiabsdcon.org/entry/talk/DSEXKX/
END:VEVENT
END:VCALENDAR