Iโve been replacing sudo/doas on most of my FreeBSD boxes with something much smaller: mdo(1) + mac_do(4) from base.
No port. No sudoers parser. No setuid helper. Just a kernel MAC policy, a sysctl rule, and an explicit โSSH is the gateโ security model.
Wrote up the full walkthrough for FreeBSD 15, including rule syntax, examples, caveats, and my surrounding hardening sysctls:
https://blog.hofstede.it/mdo-on-freebsd-15-base-system-privilege-delegation-with-mac_do/
New ๐จ๐ฝ๐น๐ถ๐ณ๐ ๐ฃ๐ฟ๐ถ๐๐ถ๐น๐ฒ๐ด๐ฒ๐ ๐ผ๐ป ๐๐ฟ๐ฒ๐ฒ๐๐ฆ๐ [Uplift Privileges on FreeBSD] article on vermaden.wordpress.com blog
https://vermaden.wordpress.com/2026/03/01/uplift-privileges-on-freebsd/
#verblog #freebsd #linux #illumos #solaris #sudo #doas #su #mdo
New ๐จ๐ฝ๐น๐ถ๐ณ๐ ๐ฃ๐ฟ๐ถ๐๐ถ๐น๐ฒ๐ด๐ฒ๐ ๐ผ๐ป ๐๐ฟ๐ฒ๐ฒ๐๐ฆ๐ [Uplift Privileges on FreeBSD] article on vermaden.wordpress.com blog
https://vermaden.wordpress.com/2026/03/01/uplift-privileges-on-freebsd/
#verblog #freebsd #linux #illumos #solaris #sudo #doas #su #mdo
One specific change I noticed is that #Safelink capabilities are moved from add-on #MDO to E3 & Business plans, which I've been advocating for (IMHO this is basic security). As #Phishing or #BEC impact is still high according to #Microsoft Digital Defense Report 2025, this is a change that can make #security defense more in-depth.
Reread the report: https://www.microsoft.com/en-us/corporate-responsibility/cybersecurity/microsoft-digital-defense-report-2025/?wt.mc_id=M365-MVP-5000976
What do you think of these changes? Is the price increase warranted? What did you miss and wanted to see? Let me know!