diff --git a/sys/security/mac_do/mac_do.c b/sys/security/mac_do/mac_do.c
--- a/sys/security/mac_do/mac_do.c
+++ b/sys/security/mac_do/mac_do.c
@@ -105,7 +105,7 @@
 	}
 
 	id = strsep(&element, ":");
-	if (id == NULL) {
+	if (id == NULL || *id == '\0') {
 		error = EINVAL;
 		goto error;
 	}