I’ve been replacing sudo/doas on most of my FreeBSD boxes with something much smaller: mdo(1) + mac_do(4) from base.
No port. No sudoers parser. No setuid helper. Just a kernel MAC policy, a sysctl rule, and an explicit “SSH is the gate” security model.
Wrote up the full walkthrough for FreeBSD 15, including rule syntax, examples, caveats, and my surrounding hardening sysctls:
https://blog.hofstede.it/mdo-on-freebsd-15-base-system-privilege-delegation-with-mac_do/
New 𝗨𝗽𝗹𝗶𝗳𝘁 𝗣𝗿𝗶𝘃𝗶𝗹𝗲𝗴𝗲𝘀 𝗼𝗻 𝗙𝗿𝗲𝗲𝗕𝗦𝗗 [Uplift Privileges on FreeBSD] article on vermaden.wordpress.com blog
https://vermaden.wordpress.com/2026/03/01/uplift-privileges-on-freebsd/
#verblog #freebsd #linux #illumos #solaris #sudo #doas #su #mdo
New 𝗨𝗽𝗹𝗶𝗳𝘁 𝗣𝗿𝗶𝘃𝗶𝗹𝗲𝗴𝗲𝘀 𝗼𝗻 𝗙𝗿𝗲𝗲𝗕𝗦𝗗 [Uplift Privileges on FreeBSD] article on vermaden.wordpress.com blog
https://vermaden.wordpress.com/2026/03/01/uplift-privileges-on-freebsd/
#verblog #freebsd #linux #illumos #solaris #sudo #doas #su #mdo
One specific change I noticed is that #Safelink capabilities are moved from add-on #MDO to E3 & Business plans, which I've been advocating for (IMHO this is basic security). As #Phishing or #BEC impact is still high according to #Microsoft Digital Defense Report 2025, this is a change that can make #security defense more in-depth.
Reread the report: https://www.microsoft.com/en-us/corporate-responsibility/cybersecurity/microsoft-digital-defense-report-2025/?wt.mc_id=M365-MVP-5000976
What do you think of these changes? Is the price increase warranted? What did you miss and wanted to see? Let me know!
matuzalem
Larvitz 
Björn Müller
vermaden
vermaden
🅱🅸🅶🅾🆁🆁🅴.🅾🆁🅶
dmstork