> For the complete documentation index, see [llms.txt](https://book.bsdcn.org/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://book.bsdcn.org/man/man4/mac_ifoff.4.md).

# mac\_ifoff.4

`mac_ifoff` — 接口静默策略

## 名称

`mac_ifoff`

## 概要

要将接口静默策略编译进内核，请在内核配置文件中加入以下行：

> options MAC options MAC\_IFOFF

或者，要在引导时加载接口静默策略模块，请在内核配置文件中加入以下行：

> options MAC

并在 loader.conf(5) 中加入：

```sh
mac_ifoff_load="YES"
```

## 描述

`mac_ifoff` 接口静默模块允许管理员通过 [sysctl(8)](/man/man8/sysctl.8.md) 接口启用和禁用系统网络接口上的传入和传出数据流。

要禁用环回（[lo(4)](/man/man4/lo.4.md)）接口上的网络流量，将 [sysctl(8)](/man/man8/sysctl.8.md) OID `security.mac.ifoff.lo_enabled` 设为 0（默认 1）。

要启用其他接口上的网络流量，将 [sysctl(8)](/man/man8/sysctl.8.md) OID `security.mac.ifoff.other_enabled` 设为 1（默认 0）。

要允许接收 BPF 流量（即使其他流量被禁用），将 [sysctl(8)](/man/man8/sysctl.8.md) OID `security.mac.ifoff.bpfrecv_enabled` 设为 1（默认 0）。

### 标签格式

未定义任何标签。

## 参见

[mac(4)](/man/man4/mac.4.md), [mac\_bsdextended(4)](/man/man4/mac_bsdextended.4.md), [mac\_lomac(4)](/man/man4/mac_lomac.4.md), [mac\_mls(4)](/man/man4/mac_mls.4.md), [mac\_none(4)](/man/man4/mac_none.4.md), [mac\_partition(4)](/man/man4/mac_partition.4.md), [mac\_portacl(4)](/man/man4/mac_portacl.4.md), [mac\_seeotheruids(4)](/man/man4/mac_seeotheruids.4.md), [mac\_test(4)](/man/man4/mac_test.4.md), [mac(9)](https://github.com/FreeBSD-Ask/freebsd-man-sc/blob/main/man9/mac.9.md)

## 历史

`mac_ifoff` 策略模块首次出现于 FreeBSD 5.0，由 TrustedBSD 项目开发。

## 作者

本软件由 Network Associates Labs（Network Associates Inc. 的安全研究部门）在 DARPA/SPAWAR 合同 N66001-01-C-8035（“CBOSS”）下，作为 DARPA CHATS 研究计划的一部分贡献给 FreeBSD 项目。

## 缺陷

虽然 MAC 框架设计旨在支持对 root 用户的限制，但并非所有攻击渠道目前都受到入口点检查的保护。因此，不应单独依赖 MAC 框架策略来防范恶意的特权用户。


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://book.bsdcn.org/man/man4/mac_ifoff.4.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.