Page MenuHomeFreeBSD
Differential D53362

libutil: defer setting the MAC label until after the login class
ClosedPublic
Actions

Authored by kevans on Oct 26 2025, 3:01 PM.
Tags
None
Referenced Files
Unknown Object (File)
Tue, Aug 11, 11:07 PM
Unknown Object (File)
Tue, Aug 11, 11:05 PM
Unknown Object (File)
Tue, Aug 11, 11:01 PM
Unknown Object (File)
Sun, Aug 9, 5:09 AM
Unknown Object (File)
Jul 15 2026, 6:51 AM
Unknown Object (File)
Jul 15 2026, 6:51 AM
Unknown Object (File)
Jul 3 2026, 12:52 PM
Unknown Object (File)
Jul 3 2026, 5:28 AM
View All 59 Files
Subscribers
andrew_tao173.riddles.org.uk
imp

Details

Reviewers
des
olce
Commits
rG98edcbcce0a4: libutil: defer setting the MAC label until after the login class
Summary

MAC policies, like mac_biba(4), may forbid changing the login class once
a label has been applied. For setting up the initial login context,
this isn't really expected and in-fact may break some class-based
configuration.

Defer setting the MAC label until after the login class is set, and
remove the requirement that we have a pwd entry since the label is
pulled from the login class -- we only use pwd for syslog in this path.

Patch is largely by Kevin Barry, with some modifications and this commit
message by kevans@.

PR: 177698
Co-authored-by: Kevin Barry <ta0kira gmail com>

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped
Build Status
Buildable 68126
Build 65009: arc lint + arc unit

Revision Contents
Changeset List

PathSize
lib/
libutil/
55 lines

Diff 165075

View Options

lib/libutil/login_class.c

Loading...