Page MenuHomeFreeBSD
Differential D53362

libutil: defer setting the MAC label until after the login class
ClosedPublic
Actions

Authored by kevans on Oct 26 2025, 3:01 PM.
Tags
None
Referenced Files
Unknown Object (File)
Sun, Sep 20, 8:21 PM
Unknown Object (File)
Tue, Sep 15, 10:52 PM
Unknown Object (File)
Mon, Sep 14, 3:12 PM
Unknown Object (File)
Sun, Sep 13, 12:07 PM
Unknown Object (File)
Sat, Sep 5, 2:52 PM
Unknown Object (File)
Sat, Sep 5, 2:12 PM
Unknown Object (File)
Thu, Sep 3, 12:09 PM
Unknown Object (File)
Tue, Sep 1, 11:53 AM
View All 71 Files
Subscribers
andrew_tao173.riddles.org.uk
imp

Details

Reviewers
des
olce
Commits
rG98edcbcce0a4: libutil: defer setting the MAC label until after the login class
Summary

MAC policies, like mac_biba(4), may forbid changing the login class once
a label has been applied. For setting up the initial login context,
this isn't really expected and in-fact may break some class-based
configuration.

Defer setting the MAC label until after the login class is set, and
remove the requirement that we have a pwd entry since the label is
pulled from the login class -- we only use pwd for syslog in this path.

Patch is largely by Kevin Barry, with some modifications and this commit
message by kevans@.

PR: 177698
Co-authored-by: Kevin Barry <ta0kira gmail com>

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped
Build Status
Buildable 68126
Build 65009: arc lint + arc unit

Revision Contents
Changeset List

PathSize
lib/
libutil/
55 lines

Diff 165075

View Options

lib/libutil/login_class.c

Loading...