How to use mdo in 5 steps

0. The steps 2 to 4 assume that you either are user root or switched to it by using su(1)
1. Test the Ring 3 command mdo(1) for the status quo as a normal user

mdo whoami
mdo: setcred(): Operation not permitted

2. Enable the Ring 0 module mac_do(4) by editing the loader.conf(5) file with ee(1)

ee /boot/loader.conf
mac_do_load="YES"

3. Load the Ring 0 module mac_do(4) with kldload(8) or just reboot with shutdown(8)

kldload mac_do

or

shutdown -r now

(first command will load the module immediately, the second one will load it via the previously added loader.conf entry)

4. Configure the rules by editing the sysctl.conf(5) file with ee(1) and load them into memory with sysctl(8)

ee /etc/sysctl.conf
# mac_do rules
security.mac.do.rules="gid=0>uid=0,gid=*,+gid=*"

and

sysctl security.mac.do.rules="gid=0>uid=0,gid=*,+gid=*"

(the rules in the file are only loaded at the next boot so we also have to load them into memory with sysctl)

5. Use the Ring 3 command mdo(1) as a normal user (use exit(1) if you are still elevated as root)

mdo whoami
root

This was just a quick TL;DR tutorial, for more details on why you should or shouldn't use it, read the articles here and here.

Don't you just love minimalism. :-)