Differential D58013

MAC/do: rename exec paths to trusted_bins
Needs ReviewPublic
Actions

Authored by polyduekes_proton.me on Jul 2 2026, 9:07 PM.

Tags

None

Referenced Files

	Unknown Object (File)
	Thu, Sep 10, 6:43 PM

	Unknown Object (File)
	Wed, Sep 9, 10:04 PM

	Unknown Object (File)
	Tue, Sep 8, 1:00 PM

	Unknown Object (File)
	Mon, Sep 7, 9:27 PM

	Unknown Object (File)
	Sun, Sep 6, 8:12 PM

	Unknown Object (File)
	Sat, Sep 5, 2:45 PM

	Unknown Object (File)
	Fri, Sep 4, 6:46 AM

	Unknown Object (File)
	Thu, Sep 3, 5:05 PM

View All 49 Files

Subscribers

Details

Reviewers

olce
bapt

Summary

the current "executable paths" feature limits which binaries can
call setcred(), with the addition of the exec constraint feature
that limits what paths can be exec'ed by an userland supervisor
such as mdo,the rename will make it clear to distinguish between
both.

Depends on D58012

Signed-off-by: polyduekes <polyduekes@proton.me>

Diff Detail

Repository

rG FreeBSD src repository

Lint

Lint Passed

Unit

No Test Coverage

Build Status

Buildable 74489
Build 71372: arc lint + arc unit

Event Timeline

polyduekes_proton.me created this revision.Jul 2 2026, 9:07 PM

Herald added a subscriber: imp. · View Herald TranscriptJul 2 2026, 9:07 PM

polyduekes_proton.me requested review of this revision.Jul 2 2026, 9:07 PM

Harbormaster completed remote builds in B74489: Diff 181233.Jul 2 2026, 9:07 PM

polyduekes_proton.me added a child revision: D58015: MAC/do: clone exec_paths along with the rest of the rules.Jul 2 2026, 9:16 PM

polyduekes_proton.me added a child revision: D58014: MAC/do: cleanups for the exec_paths objects.Jul 2 2026, 9:25 PM

polyduekes_proton.me removed a child revision: D58015: MAC/do: clone exec_paths along with the rest of the rules.

olce mentioned this in D58012: MAC/do: add exec whitelist/blacklist support for mac_do consumers.Jul 23 2026, 3:21 AM

Revision Contents
Changeset List

Path

Size

sys/

security/

mac_do/

184 lines

Diff 181233

sys/security/mac_do/mac_do.c

Loading...