diff --git a/sys/security/mac_do/mac_do.c b/sys/security/mac_do/mac_do.c
--- a/sys/security/mac_do/mac_do.c
+++ b/sys/security/mac_do/mac_do.c
@@ -331,7 +331,7 @@
 }
 
 SYSCTL_PROC(_security_mac_do, OID_AUTO, rules,
-    CTLTYPE_STRING|CTLFLAG_RW|CTLFLAG_MPSAFE,
+    CTLTYPE_STRING|CTLFLAG_RW|CTLFLAG_PRISON|CTLFLAG_MPSAFE,
     0, 0, sysctl_rules, "A",
     "Rules");