---
name: "mac_ddb"
section: "4"
platform: "freebsd"
package: "base"
version: "16.0-CURRENT-20261027-61c70dc16a79"
release: "FreeBSD 16.0-CURRENT (2026-10-27)"
platforms: ["freebsd"]
url: "https://new.carta.tech/mac_ddb"
---

# mac\_ddb(4)

Restricted kernel debugger interface policy

## NAME

**mac\_ddb** – Restricted kernel debugger interface policy

## SYNOPSIS

To compile the ddb policy into your kernel, place the following lines in your kernel configuration file:

**options MAC** **options MAC\_DDB**

Alternately, to load the ddb module at boot time, place the following line in your kernel configuration file:

**options MAC**

and in [loader.conf(5)](/loader.conf/5.md):

```
mac_ddb_load="YES"
```

## DESCRIPTION

The **mac\_ddb** policy module implements a MAC policy which restricts the set of commands that can be used at the [ddb(4)](/ddb/4.md) command prompt. The subset of permitted commands is limited to those which do not read or write to arbitrary memory locations. This is done to deter the possible extraction of system secrets while still allowing enough debugger functionality to diagnose a kernel panic. For example, the **trace** or **show** **registers** commands are allowed by this policy, but **show** **buffer** *addr* is not.

All debugger commands that are declared with the *DB\_CMD\_MEMSAFE* flag are allowed by **mac\_ddb**. The policy provides validation functions to conditionally allow some additional commands, based on the user provided arguments.

When loaded, the **mac\_ddb** policy also ensures that only the [ddb(4)](/ddb/4.md) debugger backend may be executed; [gdb(4)](/gdb/4.md) may not.

### Label Format

No labels are defined for **mac\_ddb**.

## SEE ALSO

[ddb(4)](/ddb/4.md), [mac(4)](/mac/4.md), [mac\_biba(4)](/mac_biba/4.md), [mac\_bsdextended(4)](/mac_bsdextended/4.md), [mac\_ifoff(4)](/mac_ifoff/4.md), [mac\_lomac(4)](/mac_lomac/4.md), [mac\_mls(4)](/mac_mls/4.md), [mac\_none(4)](/mac_none/4.md), [mac\_partition(4)](/mac_partition/4.md), [mac\_portacl(4)](/mac_portacl/4.md), [mac\_seeotheruids(4)](/mac_seeotheruids/4.md), [mac\_test(4)](/mac_test/4.md), [mac(9)](/mac/9.md)

## BUGS

While the MAC Framework design is intended to support the containment of the root user, not all attack channels are currently protected by entry point checks. As such, MAC Framework policies should not be relied on, in isolation, to protect against a malicious privileged user.