diff options
author | trhodes <trhodes@FreeBSD.org> | 2005-09-30 23:41:10 +0000 |
---|---|---|
committer | trhodes <trhodes@FreeBSD.org> | 2005-09-30 23:41:10 +0000 |
commit | b8a072188dcd05e45ca7c8b01129b75cdb6c3e6a (patch) | |
tree | 60f01d6168e04125e8b3f188e1ae098570859e29 /sys/security/mac_seeotheruids | |
parent | 3c83a9762a1de398e272a7b7f41727b46006549d (diff) | |
download | FreeBSD-src-b8a072188dcd05e45ca7c8b01129b75cdb6c3e6a.zip FreeBSD-src-b8a072188dcd05e45ca7c8b01129b75cdb6c3e6a.tar.gz |
Allow the root user to be aware of other credentials by virtue
of privilege.
Submitted by: rwatson
Diffstat (limited to 'sys/security/mac_seeotheruids')
-rw-r--r-- | sys/security/mac_seeotheruids/mac_seeotheruids.c | 14 |
1 files changed, 12 insertions, 2 deletions
diff --git a/sys/security/mac_seeotheruids/mac_seeotheruids.c b/sys/security/mac_seeotheruids/mac_seeotheruids.c index d2e856f..b15dc00 100644 --- a/sys/security/mac_seeotheruids/mac_seeotheruids.c +++ b/sys/security/mac_seeotheruids/mac_seeotheruids.c @@ -84,6 +84,14 @@ SYSCTL_INT(_security_mac_seeotheruids, OID_AUTO, primarygroup_enabled, "with the same real primary group id"); /* + * Exception: allow the root user to be aware of other credentials by virtue + * of privilege. + */ +static int suser_privileged = 1; +SYSCTL_INT(_security_mac_seeotheruids, OID_AUTO, suser_privileged, + CTLFLAG_RW, &suser_privileged, 0, "Make an exception for superuser"); + +/* * Exception: allow processes with a specific gid to be exempt from the * policy. One sysctl enables this functionality; the other sets the * exempt gid. @@ -117,8 +125,10 @@ mac_seeotheruids_check(struct ucred *u1, struct ucred *u2) if (u1->cr_ruid == u2->cr_ruid) return (0); - if (suser_cred(u1, 0) == 0) - return (0); + if (suser_privileged) { + if (suser_cred(u1, 0) == 0) + return (0); + } return (ESRCH); } |