GID instead of effective ones
ClosedPublic
Actions

Authored by olce on Nov 29 2024, 8:37 PM.

Details

Reviewers

emaste
bapt

Commits

rG8f72bcd9fd5d: MAC/do: Apply a rule on real UID/GID instead of effective ones
rGde701f9bdbe0: MAC/do: Apply a rule on real UID/GID instead of effective ones

Summary

We intend MAC/do to authorize transitions based on the "real" identity
information of the calling process, rather than transiently-acquired
effective IDs.

Diff Detail

Repository

rG FreeBSD src repository

Lint

Lint Not Applicable

Unit

Tests Not Applicable

Event Timeline

olce created this revision.Nov 29 2024, 8:37 PM

Herald added a subscriber: imp. · View Herald TranscriptNov 29 2024, 8:37 PM

olce requested review of this revision.Nov 29 2024, 8:37 PM

Harbormaster completed remote builds in B60884: Diff 147176.Nov 29 2024, 8:37 PM

olce added a parent revision: D47624: MAC/do: Convert internal TAILQs to STAILQs.Nov 29 2024, 8:37 PM

olce added reviewers: emaste, bapt.

olce added a subscriber: jlduran.

bapt accepted this revision.Dec 2 2024, 8:58 AM

This revision is now accepted and ready to land.Dec 2 2024, 8:58 AM

Closed by commit rGde701f9bdbe0: MAC/do: Apply a rule on real UID/GID instead of effective ones (authored by olce). · Explain WhyDec 16 2024, 2:47 PM

This revision was automatically updated to reflect the committed changes.

olce added a commit: rGde701f9bdbe0: MAC/do: Apply a rule on real UID/GID instead of effective ones.

olce added a commit: rG8f72bcd9fd5d: MAC/do: Apply a rule on real UID/GID instead of effective ones.Apr 3 2025, 7:35 PM

Revision Contents
Changeset List

Path

Size

sys/

security/

mac_do/

mac_do.c

4 lines

Diff 148076

View Options

sys/security/mac_do/mac_do.c

MAC/do: Apply a rule on real UID/GID instead of effective onesClosedPublicActions