diff options
| author | rwatson <rwatson@FreeBSD.org> | 2011-03-01 13:23:37 +0000 |
|---|---|---|
| committer | rwatson <rwatson@FreeBSD.org> | 2011-03-01 13:23:37 +0000 |
| commit | 6894aabcb5bf68abef0875992b3fef1fde3f7c0a (patch) | |
| tree | d773ba10cfdbd686d9589ba5d6bfce8bdd97f0d1 /sys/kern/kern_proc.c | |
| parent | 0fbd4a42792bb396f7a17bd8ed9eea61339f2d5b (diff) | |
| download | FreeBSD-src-6894aabcb5bf68abef0875992b3fef1fde3f7c0a.zip FreeBSD-src-6894aabcb5bf68abef0875992b3fef1fde3f7c0a.tar.gz | |
Add initial support for Capsicum's Capability Mode to the FreeBSD kernel,
compiled conditionally on options CAPABILITIES:
Add a new credential flag, CRED_FLAG_CAPMODE, which indicates that a
subject (typically a process) is in capability mode.
Add two new system calls, cap_enter(2) and cap_getmode(2), which allow
setting and querying (but never clearing) the flag.
Export the capability mode flag via process information sysctls.
Sponsored by: Google, Inc.
Reviewed by: anderson
Discussed with: benl, kris, pjd
Obtained from: Capsicum Project
MFC after: 3 months
Diffstat (limited to 'sys/kern/kern_proc.c')
| -rw-r--r-- | sys/kern/kern_proc.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/sys/kern/kern_proc.c b/sys/kern/kern_proc.c index 422a16f..1e576ed 100644 --- a/sys/kern/kern_proc.c +++ b/sys/kern/kern_proc.c @@ -725,7 +725,9 @@ fill_kinfo_proc_only(struct proc *p, struct kinfo_proc *kp) kp->ki_uid = cred->cr_uid; kp->ki_ruid = cred->cr_ruid; kp->ki_svuid = cred->cr_svuid; - kp->ki_cr_flags = cred->cr_flags; + kp->ki_cr_flags = 0; + if (cred->cr_flags & CRED_FLAG_CAPMODE) + kp->ki_cr_flags |= KI_CRF_CAPABILITY_MODE; /* XXX bde doesn't like KI_NGROUPS */ if (cred->cr_ngroups > KI_NGROUPS) { kp->ki_ngroups = KI_NGROUPS; |
