GID instead of effective ones
AcceptedPublic
Actions

Authored by olce on Fri, Nov 29, 8:37 PM.

Details

Reviewers

emaste
bapt

Summary

We intend MAC/do to authorize transitions based on the "real" identity
information of the calling process, rather than transiently-acquired
effective IDs.

Diff Detail

Repository

rG FreeBSD src repository

Lint

Lint Skipped

Unit

Tests Skipped

Build Status

Buildable 60884
Build 57768: arc lint + arc unit

Event Timeline

olce created this revision.Fri, Nov 29, 8:37 PM

Herald added a subscriber: imp. · View Herald TranscriptFri, Nov 29, 8:37 PM

olce requested review of this revision.Fri, Nov 29, 8:37 PM

Harbormaster completed remote builds in B60884: Diff 147176.Fri, Nov 29, 8:37 PM

olce added a parent revision: D47624: MAC/do: Convert internal TAILQs to STAILQs.Fri, Nov 29, 8:37 PM

olce added reviewers: emaste, bapt.

olce added a subscriber: jlduran.

bapt accepted this revision.Mon, Dec 2, 8:58 AM

This revision is now accepted and ready to land.Mon, Dec 2, 8:58 AM

Revision Contents
Changeset List

Path

Size

sys/

security/

mac_do/

mac_do.c

4 lines

Diff 147176

View Options

sys/security/mac_do/mac_do.c

MAC/do: Apply a rule on real UID/GID instead of effective onesAcceptedPublicActions