---
name: "maclabel"
section: "7"
platform: "freebsd"
package: "base"
version: "16.0-CURRENT-20261027-61c70dc16a79"
release: "FreeBSD 16.0-CURRENT (2026-10-27)"
platforms: ["freebsd"]
url: "https://new.carta.tech/maclabel"
---

# maclabel(7)

Mandatory Access Control label format

## NAME

**maclabel** – Mandatory Access Control label format

## DESCRIPTION

If Mandatory Access Control, or MAC, is enabled in the kernel, then in addition to the traditional credentials, each subject (typically a user or a socket) and object (file system object, socket, etc.) is given a *MAC label*. The MAC label specifies the necessary subject-specific or object-specific information necessary for a MAC security policy to enforce access control on the subject/object.

The format for a MAC label is defined as follows:

*policy1*/*qualifier1*,*policy2*/*qualifier2*,...

A MAC label consists of a policy name, followed by a forward slash, followed by the subject or object's qualifier, optionally followed by a comma and one or more additional policy labels. For example:

```
biba/low(low-low)
biba/high(low-high),mls/equal(equal-equal),partition/0
```

## SEE ALSO

[mac(3)](/mac/3.md), [posix1e(3)](/posix1e/3.md), [mac\_biba(4)](/mac_biba/4.md), [mac\_bsdextended(4)](/mac_bsdextended/4.md), [mac\_ifoff(4)](/mac_ifoff/4.md), [mac\_mls(4)](/mac_mls/4.md), [mac\_none(4)](/mac_none/4.md), [mac\_partition(4)](/mac_partition/4.md), [mac\_seeotheruids(4)](/mac_seeotheruids/4.md), [mac\_test(4)](/mac_test/4.md), [login.conf(5)](/login.conf/5.md), [getfmac(8)](/getfmac/8.md), [getpmac(8)](/getpmac/8.md), [ifconfig(8)](/ifconfig/8.md), [setfmac(8)](/setfmac/8.md), [setpmac(8)](/setpmac/8.md), [mac(9)](/mac/9.md)

## HISTORY

MAC first appeared in FreeBSD 5.0.

## AUTHORS

This software was contributed to the FreeBSD Project by NAI Labs, the Security Research Division of Network Associates Inc. under DARPA/SPAWAR contract N66001-01-C-8035 (“CBOSS”), as part of the DARPA CHATS research program.