blacklist support for mac_do consumers
Needs ReviewPublic
Actions

Authored by polyduekes_proton.me on Thu, Jul 2, 9:04 PM.

Details

Reviewers

olce
bapt
markj

Summary

this adds support for an optional exec paths list to the
security.mac.do.rules sysctl which allows for a whitelist
/blacklist for paths allowed to be exec'ed by userland
supervisors such as mdo

Signed-off-by: polyduekes <polyduekes@proton.me>

Diff Detail

Repository

rG FreeBSD src repository

Lint

Lint Passed

Unit

No Test Coverage

Build Status

Buildable 74488
Build 71371: arc lint + arc unit

Event Timeline

polyduekes_proton.me created this revision.Thu, Jul 2, 9:04 PM

Herald added a subscriber: imp. · View Herald TranscriptThu, Jul 2, 9:04 PM

polyduekes_proton.me requested review of this revision.Thu, Jul 2, 9:04 PM

Harbormaster completed remote builds in B74488: Diff 181232.Thu, Jul 2, 9:04 PM

polyduekes_proton.me added a child revision: D58013: MAC/do: rename exec paths to trusted_bins.Thu, Jul 2, 9:07 PM

polyduekes_proton.me added a child revision: D58014: MAC/do: cleanups for the exec_paths objects.Thu, Jul 2, 9:11 PM

polyduekes_proton.me added a child revision: D58015: MAC/do: clone exec_paths along with the rest of the rules.Thu, Jul 2, 9:16 PM

polyduekes_proton.me removed a child revision: D58014: MAC/do: cleanups for the exec_paths objects.Thu, Jul 2, 9:25 PM

polyduekes_proton.me removed a child revision: D58015: MAC/do: clone exec_paths along with the rest of the rules.

Revision Contents
Changeset List

Path

Size

sys/

security/

mac_do/

mac_do.c

250 lines

Diff 181232

View Options

sys/security/mac_do/mac_do.c

MAC/do: add exec whitelist/blacklist support for mac_do consumersNeeds ReviewPublicActions