diff --git a/tests/sys/mac/portacl/Makefile b/tests/sys/mac/portacl/Makefile
index 856a85d331d5..28c3a5cd71ce 100644
--- a/tests/sys/mac/portacl/Makefile
+++ b/tests/sys/mac/portacl/Makefile
@@ -1,16 +1,17 @@
 PACKAGE=	tests
 
 TESTSDIR=	${TESTSBASE}/sys/mac/portacl
 
 ${PACKAGE}FILES+=	misc.sh
 
 TAP_TESTS_SH+=	nobody_test
 TAP_TESTS_SH+=	root_test
 
 .for t in ${TAP_TESTS_SH}
+TEST_METADATA.$t+=	required_kmods="mac_portacl"
 TEST_METADATA.$t+=	required_user="root"
 TEST_METADATA.$t+=	timeout="450"
 TEST_METADATA.$t+=	is_exclusive="true"
 .endfor
 
 .include <bsd.test.mk>
diff --git a/tests/sys/mac/portacl/misc.sh b/tests/sys/mac/portacl/misc.sh
index a1b729c87777..4d3f18fce1c1 100644
--- a/tests/sys/mac/portacl/misc.sh
+++ b/tests/sys/mac/portacl/misc.sh
@@ -1,106 +1,98 @@
 #!/bin/sh
 
-sysctl security.mac.portacl >/dev/null 2>&1
-if [ $? -ne 0 ]; then
-	echo "1..0 # SKIP MAC_PORTACL is unavailable."
-	exit 0
-fi
-if [ $(id -u) -ne 0 ]; then
-	echo "1..0 # SKIP testcases must be run as root"
-	exit 0
-fi
-
 ntest=1
 
 check_bind() {
 	local host idtype name proto port udpflag
 
 	host="127.0.0.1"
 	timeout=1
 
 	idtype=${1}
 	name=${2}
 	proto=${3}
 	port=${4}
 
 	[ "${proto}" = "udp" ] && udpflag="-u"
 
 	out=$(
 		case "${idtype}" in
 		uid|gid)
 			( echo -n | su -m ${name} -c "nc ${udpflag} -l -w ${timeout} $host $port" 2>&1 ) &
 			;;
 		jail)
 			kill $$
 			;;
 		*)
 			kill $$
 		esac
 		sleep 0.3
 		echo | nc ${udpflag} -w ${timeout} $host $port >/dev/null 2>&1
 		wait
 	)
 	case "${out}" in
 	"nc: Permission denied"*|"nc: Operation not permitted"*)
 		echo fl
 		;;
 	"")
 		echo ok
 		;;
 	*)
 		echo ${out}
 		;;
 	esac
 }
 
 bind_test() {
 	local expect_without_rule expect_with_rule idtype name proto port
 
 	expect_without_rule=${1}
 	expect_with_rule=${2}
 	idtype=${3}
 	name=${4}
 	proto=${5}
 	port=${6}
 
 	sysctl security.mac.portacl.rules= >/dev/null
 	out=$(check_bind ${idtype} ${name} ${proto} ${port})
 	if [ "${out}" = "${expect_without_rule}" ]; then
 		echo "ok ${ntest}"
 	elif [ "${out}" = "ok" -o "${out}" = "fl" ]; then
 		echo "not ok ${ntest} # '${out}' != '${expect_without_rule}'"
 	else
 		echo "not ok ${ntest} # unexpected output: '${out}'"
 	fi
 	: $(( ntest += 1 ))
 
 	if [ "${idtype}" = "uid" ]; then
 		idstr=$(id -u ${name})
 	elif [ "${idtype}" = "gid" ]; then
 		idstr=$(id -g ${name})
 	else
 		idstr=${name}
 	fi
 	sysctl security.mac.portacl.rules=${idtype}:${idstr}:${proto}:${port} >/dev/null
 	out=$(check_bind ${idtype} ${name} ${proto} ${port})
 	if [ "${out}" = "${expect_with_rule}" ]; then
 		echo "ok ${ntest}"
 	elif [ "${out}" = "ok" -o "${out}" = "fl" ]; then
 		echo "not ok ${ntest} # '${out}' != '${expect_with_rule}'"
 	else
 		echo "not ok ${ntest} # unexpected output: '${out}'"
 	fi
 	: $(( ntest += 1 ))
 
 	sysctl security.mac.portacl.rules= >/dev/null
 }
 
+portacl_enabled=$(sysctl -n security.mac.portacl.enabled)
 reserved_high=$(sysctl -n net.inet.ip.portrange.reservedhigh)
 suser_exempt=$(sysctl -n security.mac.portacl.suser_exempt)
 port_high=$(sysctl -n security.mac.portacl.port_high)
 
 restore_settings() {
 	sysctl -n net.inet.ip.portrange.reservedhigh=${reserved_high} >/dev/null
 	sysctl -n security.mac.portacl.suser_exempt=${suser_exempt} >/dev/null
 	sysctl -n security.mac.portacl.port_high=${port_high} >/dev/null
+	sysctl -n security.mac.portacl.enabled=${portacl_enabled} >/dev/null
 }
diff --git a/tests/sys/mac/portacl/nobody_test.sh b/tests/sys/mac/portacl/nobody_test.sh
index 7e64f68113ea..a3f2168dc81d 100644
--- a/tests/sys/mac/portacl/nobody_test.sh
+++ b/tests/sys/mac/portacl/nobody_test.sh
@@ -1,66 +1,67 @@
 #!/bin/sh
 
 dir=`dirname $0`
 . ${dir}/misc.sh
 
 echo "1..64"
 
 # security.mac.portacl.suser_exempt value doesn't affect unprivileged users
 # behaviour.
 # mac_portacl has no impact on ports <= net.inet.ip.portrange.reservedhigh.
 
 trap restore_settings EXIT INT TERM
 
 sysctl security.mac.portacl.suser_exempt=1 >/dev/null
 sysctl net.inet.ip.portrange.reservedhigh=78 >/dev/null
+sysctl security.mac.portacl.enabled=1 >/dev/null
 
 bind_test fl fl uid nobody tcp 77
 bind_test ok ok uid nobody tcp 7777
 bind_test fl fl uid nobody udp 77
 bind_test ok ok uid nobody udp 7777
 
 bind_test fl fl gid nobody tcp 77
 bind_test ok ok gid nobody tcp 7777
 bind_test fl fl gid nobody udp 77
 bind_test ok ok gid nobody udp 7777
 
 sysctl security.mac.portacl.suser_exempt=0 >/dev/null
 
 bind_test fl fl uid nobody tcp 77
 bind_test ok ok uid nobody tcp 7777
 bind_test fl fl uid nobody udp 77
 bind_test ok ok uid nobody udp 7777
 
 bind_test fl fl gid nobody tcp 77
 bind_test ok ok gid nobody tcp 7777
 bind_test fl fl gid nobody udp 77
 bind_test ok ok gid nobody udp 7777
 
 # Verify if security.mac.portacl.port_high works.
 
 sysctl security.mac.portacl.port_high=7778 >/dev/null
 
 bind_test fl fl uid nobody tcp 77
 bind_test fl ok uid nobody tcp 7777
 bind_test fl fl uid nobody udp 77
 bind_test fl ok uid nobody udp 7777
 
 bind_test fl fl gid nobody tcp 77
 bind_test fl ok gid nobody tcp 7777
 bind_test fl fl gid nobody udp 77
 bind_test fl ok gid nobody udp 7777
 
 # Verify if mac_portacl rules work.
 
 sysctl net.inet.ip.portrange.reservedhigh=76 >/dev/null
 sysctl security.mac.portacl.port_high=7776 >/dev/null
 
 bind_test fl ok uid nobody tcp 77
 bind_test ok ok uid nobody tcp 7777
 bind_test fl ok uid nobody udp 77
 bind_test ok ok uid nobody udp 7777
 
 bind_test fl ok gid nobody tcp 77
 bind_test ok ok gid nobody tcp 7777
 bind_test fl ok gid nobody udp 77
 bind_test ok ok gid nobody udp 7777
diff --git a/tests/sys/mac/portacl/root_test.sh b/tests/sys/mac/portacl/root_test.sh
index daa5b147b4fa..d8898ff4f80e 100644
--- a/tests/sys/mac/portacl/root_test.sh
+++ b/tests/sys/mac/portacl/root_test.sh
@@ -1,50 +1,51 @@
 #!/bin/sh
 
 dir=`dirname $0`
 . ${dir}/misc.sh
 
 echo "1..48"
 
 # Verify if security.mac.portacl.suser_exempt=1 really exempts super-user.
 
 trap restore_settings EXIT INT TERM
 
 sysctl security.mac.portacl.suser_exempt=1 >/dev/null
+sysctl security.mac.portacl.enabled=1 >/dev/null
 
 bind_test ok ok uid root tcp 77
 bind_test ok ok uid root tcp 7777
 bind_test ok ok uid root udp 77
 bind_test ok ok uid root udp 7777
 
 bind_test ok ok gid root tcp 77
 bind_test ok ok gid root tcp 7777
 bind_test ok ok gid root udp 77
 bind_test ok ok gid root udp 7777
 
 # Verify if security.mac.portacl.suser_exempt=0 really doesn't exempt super-user.
 
 sysctl security.mac.portacl.suser_exempt=0 >/dev/null
 
 bind_test fl ok uid root tcp 77
 bind_test ok ok uid root tcp 7777
 bind_test fl ok uid root udp 77
 bind_test ok ok uid root udp 7777
 
 bind_test fl ok gid root tcp 77
 bind_test ok ok gid root tcp 7777
 bind_test fl ok gid root udp 77
 bind_test ok ok gid root udp 7777
 
 # Verify if security.mac.portacl.port_high works for super-user.
 
 sysctl security.mac.portacl.port_high=7778 >/dev/null
 
 bind_test fl ok uid root tcp 77
 bind_test fl ok uid root tcp 7777
 bind_test fl ok uid root udp 77
 bind_test fl ok uid root udp 7777
 
 bind_test fl ok gid root tcp 77
 bind_test fl ok gid root tcp 7777
 bind_test fl ok gid root udp 77
 bind_test fl ok gid root udp 7777