summaryrefslogtreecommitdiffstats
path: root/sys/kern/kern_prot.c
Commit message (Collapse)AuthorAgeFilesLines
...
* o Update an instance of 'unprivileged_procdebug_permitted' missedrwatson2001-12-031-6/+6
| | | | | in the previous commit: the comment should also call it 'unprivileged_proc_debug'.
* o Introduce pr_mtx into struct prison, providing protection for therwatson2001-12-031-2/+8
| | | | | | | | | | | | | | | | | | mutable contents of struct prison (hostname, securelevel, refcount, pr_linux, ...) o Generally introduce mtx_lock()/mtx_unlock() calls throughout kern/ so as to enforce these protections, in particular, in kern_mib.c protection sysctl access to the hostname and securelevel, as well as kern_prot.c access to the securelevel for access control purposes. o Rewrite linux emulator abstractions for accessing per-jail linux mib entries (osname, osrelease, osversion) so that they don't return a pointer to the text in the struct linux_prison, rather, a copy to an array passed into the calls. Likewise, update linprocfs to use these primitives. o Update in_pcb.c to always use prison_getip() rather than directly accessing struct prison. Reviewed by: jhb
* o Uniformly copy uap arguments into local variables before grabbingrwatson2001-12-021-3/+1
| | | | giant, and make whitespace more consistent around giant-frobbing.
* o Remove KSE race in setuid() in which oldcred was preserved before giantrwatson2001-12-021-1/+1
| | | | | was grabbed. This was introduced in 1.101 when the giant pushdown for kern_prot.c was originally performed.
* o General style, formatting, etc, improvements:rwatson2001-12-021-167/+107
| | | | | | | | | | | | - uid's -> uids - whitespace improvements, linewrap improvements - reorder copyright more appropriately - remove redundant MP SAFE comments, add one "NOT MPSAFE?" for setgroups(), which seems to be the sole un-changed system call in the file. - clean up securelevel_g?() functions, improve comments. Largely submitted by: bde
* o Further sysctl name simplification, generally stripping 'permitted',rwatson2001-11-301-9/+9
| | | | | | | | using '_'s more consistently. Discussed with: bde, jhb Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* o Move current inhabitants of kern.security to kern.security.bsd, sorwatson2001-11-301-14/+16
| | | | | | | | | that new models can inhabit kern.security.<modelname>. o While I'm there, shorten somewhat excessive variable names, and clean things up a little. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Clean up breakage in inferior() I introduced in 1.92 of kern_proc.c:jhb2001-11-121-0/+3
| | | | | | | | | | - Restore inferior() to being iterative rather than recursive. - Assert that the proctree_lock is held in inferior() and change the one caller to get a shared lock of it. This also ensures that we hold the lock after performing the check so the check can't be made invalid out from under us after the check but before we act on it. Requested by: bde
* o Introduce group subset test, which limits the ability of a process torwatson2001-11-021-8/+36
| | | | | | | | | | | | | | | | | | | debug another process based on their respective {effective,additional, saved,real} gid's. p1 is only permitted to debug p2 if its effective gids (egid + additional groups) are a strict superset of the gids of p2. This implements properly the security test previously incorrectly implemented in kern_ktrace.c, and is consistent with the kernel security policy (although might be slightly confusing for those more familiar with the userland policy). o Restructure p_candebug() logic so that various results are generated comparing uids, gids, credential changes, and then composed in a single check before testing for privilege. These tests encapsulate the "BSD" inter-process debugging policy. Other non-BSD checks remain seperate. Additional comments are added. Submitted by: tmm, rwatson Obtained from: TrustedBSD Project Reviewed by: petef, tmm, rwatson
* o Add a comment to p_candebug() noting that the P_INEXEC check shouldrwatson2001-11-021-1/+6
| | | | | | | | | | | | really be moved elsewhere: p_candebug() encapsulates the security policy decision, whereas the P_INEXEC check has to do with "correctness" regarding race conditions, rather than security policy. Example: even if no security protections were enforced (the "uids are advisory" model), removing P_INEXEC could result in incorrect operation due to races on credential evaluation and modification during execve(). Obtained from: TrustedBSD Project
* o Capabilities cap_check() interface revised to remove _xxx, so renamerwatson2001-11-021-1/+1
| | | | | | in p_cansched(). Also, replace '0' with 'NULL' for the ucred * pointer. Obtained from: TrustedBSD Project
* Add a P_INEXEC flag that indicates that the process has called execve() anddes2001-10-271-0/+4
| | | | | | | | it has not yet returned. Use this flag to deny debugging requests while the process is execve()ing, and close once and for all any race conditions that might occur between execve() and various debugging interfaces. Reviewed by: jhb, rwatson
* Add mtx_lock_giant() and mtx_unlock_giant() wrappers for sysctl managementdillon2001-10-261-6/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | of Giant during the Giant unwinding phase, and start work on instrumenting Giant for the file and proc mutexes. These wrappers allow developers to turn on and off Giant around various subsystems. DEVELOPERS SHOULD NEVER TURN OFF GIANT AROUND A SUBSYSTEM JUST BECAUSE THE SYSCTL EXISTS! General developers should only considering turning on Giant for a subsystem whos default is off (to help track down bugs). Only developers working on particular subsystems who know what they are doing should consider turning off Giant. These wrappers will greatly improve our ability to unwind Giant and test the kernel on a (mostly) subsystem by subsystem basis. They allow Giant unwinding developers (GUDs) to emplace appropriate subsystem and structural mutexes in the main tree and then request that the larger community test the work by turning off Giant around the subsystem(s), without the larger community having to mess around with patches. These wrappers also allow GUDs to boot into a (more likely to be) working system in the midst of their unwinding work and to test that work under more controlled circumstances. There is a master sysctl, kern.giant.all, which defaults to 0 (off). If turned on it overrides *ALL* other kern.giant sysctls and forces Giant to be turned on for all wrapped subsystems. If turned off then Giant around individual subsystems are controlled by various other kern.giant.XXX sysctls. Code which overlaps multiple subsystems must have all related subsystem Giant sysctls turned off in order to run without Giant.
* Change the kernel's ucred API as follows:jhb2001-10-111-22/+29
| | | | | | | | - crhold() returns a reference to the ucred whose refcount it bumps. - crcopy() now simply copies the credentials from one credential to another and has no return value. - a new crshared() primitive is added which returns true if a ucred's refcount is > 1 and false (0) otherwise.
* Whitespace fixes.jhb2001-10-111-2/+2
|
* Rework some code to be a bit simpler by inverting a few tests and usingjhb2001-10-111-22/+12
| | | | else clauses instead of goto's.
* Add a temporary hack that will go away with the ucred API update to bzerojhb2001-10-101-0/+1
| | | | | the duplicated mutex before initializing it to avoid triggering the check for init'ing an already initialized mutex.
* - Combine kern.ps_showallprocs and kern.ipc.showallsockets intorwatson2001-10-091-2/+12
| | | | | | | | | | | | | | | | | | | | | | | a single kern.security.seeotheruids_permitted, describes as: "Unprivileged processes may see subjects/objects with different real uid" NOTE: kern.ps_showallprocs exists in -STABLE, and therefore there is an API change. kern.ipc.showallsockets does not. - Check kern.security.seeotheruids_permitted in cr_cansee(). - Replace visibility calls to socheckuid() with cr_cansee() (retain the change to socheckuid() in ipfw, where it is used for rule-matching). - Remove prison_unpcb() and make use of cr_cansee() against the UNIX domain socket credential instead of comparing root vnodes for the UDS and the process. This allows multiple jails to share the same chroot() and not see each others UNIX domain sockets. - Remove unused socheckproc(). Now that cr_cansee() is used universally for socket visibility, a variety of policies are more consistently enforced, including uid-based restrictions and jail-based restrictions. This also better-supports the introduction of additional MAC models. Reviewed by: ps, billf Obtained from: TrustedBSD Project
* o Recent addition of (p1==p2) exception in p_candebug() permittedrwatson2001-10-091-2/+9
| | | | | | | | | | processes to attach debugging to themselves even though the global kern_unprivileged_procdebug_permitted policy might disallow this. o Move the kern_unprivileged_procdebug_permitted check above the (p1==p2) check. Reviewed by: des
* Always succeed if the target process is the same as the requesting process.des2001-10-071-0/+3
|
* o When performing a securelevel check as part of securelevel_ge() orrwatson2001-09-261-8/+15
| | | | | | | | | | | | securelevel_gt(), determine first if a local securelevel exists -- if so, perform the check based on imax(local, global). Otherwise, simply use the global value. o Note: even though local securelevels might lag below the global one, if the global value is updated to higher than local values, maximum will still be used, making the global dominant even if there is local lag. Obtained from: TrustedBSD Project
* o So, when <dd> e-mailed me and said that the comment was invertedrwatson2001-09-251-6/+6
| | | | | | | for securelevel_ge() and securelevel_gt(), I was a little surprised, but fixed it. Turns out that it was the code that was inverted, during a whitespace cleanup in my commit tree. This commit inverts the checks, and restores the comment.
* o Rename u_cansee() to cr_cansee(), making the name more comprehensiblerwatson2001-09-201-3/+3
| | | | | | in the face of a rename of ucred to cred, and possibly generally. Obtained from: TrustedBSD Project
* o Clarification of securelevel_{ge,gt} comment.rwatson2001-09-191-2/+2
| | | | Submitted by: dd
* o Introduce two new calls, securelevel_gt() and securelevel_ge(), whichrwatson2001-09-181-3/+57
| | | | | | | | | | | | | | abstract the securelevel implementation details from the checking code. The call in -CURRENT accepts a struct ucred--in -STABLE, it will accept struct proc. This facilitates the upcoming commit of per-jail securelevel support. The calls will also generate a kernel printf if the calls are made with NULL ucred/proc pointers: generally speaking, there are few instances of this, and they should be fixed. o Update p_candebug() to use securelevel_gt(); future updates to the remainder of the kernel tree will be committed soon. Obtained from: TrustedBSD Project
* KSE Milestone 2julian2001-09-121-75/+124
| | | | | | | | | | | | | | Note ALL MODULES MUST BE RECOMPILED make the kernel aware that there are smaller units of scheduling than the process. (but only allow one thread per process at this time). This is functionally equivalent to teh previousl -current except that there is a thread associated with each process. Sorry john! (your next MFC will be a doosie!) Reviewed by: peter@freebsd.org, dillon@freebsd.org X-MFC after: ha ha ha ha
* Giant Pushdown. Saved the worst P4 tree breakage for last.dillon2001-09-011-80/+271
| | | | | | | | | | | | reboot() getpriority() setpriority() rtprio() osetrlimit() ogetrlimit() setrlimit() getrlimit() getrusage() getpid() getppid() getpgrp() getpgid() getsid() getgid() getegid() getgroups() setsid() setpgid() setuid() seteuid() setgid() setegid() setgroups() setreuid() setregid() setresuid() setresgid() getresuid() getresgid () __setugid() getlogin() setlogin() modnext() modfnext() modstat() modfind() kldload() kldunload() kldfind() kldnext() kldstat() kldfirstmod() kldsym() getdtablesize() dup2() dup() fcntl() close() ofstat() fstat() nfsstat() fpathconf() flock()
* o Screw over users of the kern.{security.,}suser_permitted sysctl again,rwatson2001-08-311-5/+5
| | | | | | | | | | | | by renaming it to kern.security.suser_enabled. This makes the name consistent with other use: "permitted" now refers to a specific right or privilege, whereas "enabled" refers to a feature. As this hasn't been MFC'd, and using this destroys a running system currently, I believe the user base of the sysctl will not be too unhappy. o While I'm at it, un-staticize and export the supporting variable, as it will be used by kern_cap.c shortly. Obtained from: TrustedBSD Project
* o Improve the style of a number of routines and comments in kern_prot.c,rwatson2001-08-281-66/+62
| | | | | | with regards to redundancy, formatting, and style(9). Submitted by: bde
* Fix typos in recent comments.rwatson2001-08-281-2/+2
| | | | Submitted by: dd
* Generally improve documentation of kern_prot.c:rwatson2001-08-271-10/+65
| | | | | | | | | | | | | | o Add comments for: - kern.security.suser_permitted - p_cansee() - p_cansignal() - p_cansched() - kern.security.unprivileged_procdebug_permitted - p_candebug() Update copyright. Obtained from: TrustedBSD
* o Modify p_candebug() such that there is no longer automatic acceptancerwatson2001-07-311-3/+0
| | | | | | | | | | of debugging the current process when that is in conflict with other restrictions (such as jail, unprivileged_procdebug_permitted, etc). o This corrects anomolies in the behavior of kern.security.unprivileged_procdebug_permitted when using truss and ktrace. The theory goes that this is now safe to use. Obtained from: TrustedBSD Project
* o Introduce new kern.security sysctl tree for kernel security policyrwatson2001-07-311-3/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | MIB entries. o Relocate kern.suser_permitted to kern.security.suser_permitted. o Introduce new kern.security.unprivileged_procdebug_permitted, which (when set to 0) prevents processes without privilege from performing a variety of inter-process debugging activities. The default is 1, to provide current behavior. This feature allows "hardened" systems to disable access to debugging facilities, which have been associated with a number of past security vulnerabilities. Previously, while procfs could be unmounted, other in-kernel facilities (such as ptrace()) were still available. This setting should not be modified on normal development systems, as it will result in frustration. Some utilities respond poorly to failing to get the debugging access they require, and error response by these utilities may be improved in the future in the name of beautification. Note that there are currently some odd interactions with some facilities, which will need to be resolved before this should be used in production, including odd interactions with truss and ktrace. Note also that currently, tracing is permitted on the current process regardless of this flag, for compatibility with previous authorization code in various facilities, but that will probably change (and resolve the odd interactions). Obtained from: TrustedBSD Project
* o Replace calls to p_can(..., P_CAN_xxx) with calls to p_canxxx().rwatson2001-07-051-51/+12
| | | | | | | | | | | | | | | | | | | | | The p_can(...) construct was a premature (and, it turns out, awkward) abstraction. The individual calls to p_canxxx() better reflect differences between the inter-process authorization checks, such as differing checks based on the type of signal. This has a side effect of improving code readability. o Replace direct credential authorization checks in ktrace() with invocation of p_candebug(), while maintaining the special case check of KTR_ROOT. This allows ktrace() to "play more nicely" with new mandatory access control schemes, as well as making its authorization checks consistent with other "debugging class" checks. o Eliminate "privused" construct for p_can*() calls which allowed the caller to determine if privilege was required for successful evaluation of the access control check. This primitive is currently unused, and as such, serves only to complicate the API. Approved by: ({procfs,linprocfs} changes) des Obtained from: TrustedBSD Project
* Unbreak setregid(2).ru2001-06-061-0/+2
| | | | Spotted by: Alexander Leidinger <Alexander@Leidinger.net>
* o uifree() the cr_ruidinfo in crfree() as well as cr_uidinfo now that the ↵rwatson2001-05-271-0/+2
| | | | | | | | real uid info is in the credential also. Submitted by: egge
* o Merge contents of struct pcred into struct ucred. Specifically, add therwatson2001-05-251-180/+271
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | real uid, saved uid, real gid, and saved gid to ucred, as well as the pcred->pc_uidinfo, which was associated with the real uid, only rename it to cr_ruidinfo so as not to conflict with cr_uidinfo, which corresponds to the effective uid. o Remove p_cred from struct proc; add p_ucred to struct proc, replacing original macro that pointed. p->p_ucred to p->p_cred->pc_ucred. o Universally update code so that it makes use of ucred instead of pcred, p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo, cr_{r,sv}{u,g}id instead of p_*, etc. o Remove pcred0 and its initialization from init_main.c; initialize cr_ruidinfo there. o Restruction many credential modification chunks to always crdup while we figure out locking and optimizations; generally speaking, this means moving to a structure like this: newcred = crdup(oldcred); ... p->p_ucred = newcred; crfree(oldcred); It's not race-free, but better than nothing. There are also races in sys_process.c, all inter-process authorization, fork, exec, and exit. o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid; remove comments indicating that the old arrangement was a problem. o Restructure exec1() a little to use newcred/oldcred arrangement, and use improved uid management primitives. o Clean up exit1() so as to do less work in credential cleanup due to pcred removal. o Clean up fork1() so as to do less work in credential cleanup and allocation. o Clean up ktrcanset() to take into account changes, and move to using suser_xxx() instead of performing a direct uid==0 comparision. o Improve commenting in various kern_prot.c credential modification calls to better document current behavior. In a couple of places, current behavior is a little questionable and we need to check POSIX.1 to make sure it's "right". More commenting work still remains to be done. o Update credential management calls, such as crfree(), to take into account new ruidinfo reference. o Modify or add the following uid and gid helper routines: change_euid() change_egid() change_ruid() change_rgid() change_svuid() change_svgid() In each case, the call now acts on a credential not a process, and as such no longer requires more complicated process locking/etc. They now assume the caller will do any necessary allocation of an exclusive credential reference. Each is commented to document its reference requirements. o CANSIGIO() is simplified to require only credentials, not processes and pcreds. o Remove lots of (p_pcred==NULL) checks. o Add an XXX to authorization code in nfs_lock.c, since it's questionable, and needs to be considered carefully. o Simplify posix4 authorization code to require only credentials, not processes and pcreds. Note that this authorization, as well as CANSIGIO(), needs to be updated to use the p_cansignal() and p_cansched() centralized authorization routines, as they currently do not take into account some desirable restrictions that are handled by the centralized routines, as well as being inconsistent with other similar authorization instances. o Update libkvm to take these changes into account. Obtained from: TrustedBSD Project Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
* o Modify access control checks in p_candebug() such that the policy is asrwatson2001-05-171-3/+3
| | | | | | | | | | | | follows: the effective uid of p1 (subject) must equal the real, saved, and effective uids of p2 (object), p2 must not have undergone a credential downgrade. A subject with appropriate privilege may override these protections. In the future, we will extend these checks to require that p1 effective group membership must be a superset of p2 effective group membership. Obtained from: TrustedBSD Project
* Undo part of the tangle of having sys/lock.h and sys/mutex.h included inmarkm2001-05-011-2/+3
| | | | | | | | | | | other "system" header files. Also help the deprecation of lockmgr.h by making it a sub-include of sys/lock.h and removing sys/lockmgr.h form kernel .c files. Sort sys/*.h includes where possible in affected files. OK'ed by: bde (with reservations)
* o Remove the disabled p_cansched() test cases that permitted users torwatson2001-04-271-11/+0
| | | | | | | | | modify the scheduling properties of processes with a different real uid but the same effective uid (i.e., daemons, et al). (note: these cases were previously commented out, so this does not change the compiled code at al) Obtained from: TrustedBSD Project
* Change the pfind() and zpfind() functions to lock the process that theyjhb2001-04-241-25/+47
| | | | | | find before releasing the allproc lock and returning. Reviewed by: -smp, dfr, jake
* o Remove comment indicating policy permits loop-back debugging, butrwatson2001-04-211-1/+0
| | | | | | | semantics don't: in practice, both policy and semantics permit loop-back debugging operations, only it's just a subset of debugging operations (i.e., a proc can open its own /dev/mem), and that's at a higher layer.
* Add a sanity check on ucred refcount.alfred2001-04-171-0/+1
| | | | Submitted by: Terry Lambert <terry@lambert.org>
* o Since uid checks in p_cansignal() are now identical between P_SUGIDrwatson2001-04-131-28/+14
| | | | | | | | | and non-P_SUGID cases, simplify p_cansignal() logic so that the P_SUGID masking of possible signals is independent from uid checks, removing redundant code and generally improving readability. Reviewed by: tmm Obtained from: TrustedBSD Project
* o Disallow two "allow this" exceptions in p_cansignal() restrictingrwatson2001-04-131-5/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | the ability of unprivileged processes to deliver arbitrary signals to daemons temporarily taking on unprivileged effective credentials when P_SUGID is not set on the target process: Removed: (p1->p_cred->cr_ruid != ps->p_cred->cr_uid) (p1->p_ucred->cr_uid != ps->p_cred->cr_uid) o Replace two "allow this" exceptions in p_cansignal() restricting the ability of unprivileged processes to deliver arbitrary signals to daemons temporarily taking on unprivileged effective credentials when P_SUGID is set on the target process: Replaced: (p1->p_cred->p_ruid != p2->p_ucred->cr_uid) (p1->p_cred->cr_uid != p2->p_ucred->cr_uid) With: (p1->p_cred->p_ruid != p2->p_ucred->p_svuid) (p1->p_ucred->cr_uid != p2->p_ucred->p_svuid) o These changes have the effect of making the uid-based handling of both P_SUGID and non-P_SUGID signal delivery consistent, following these four general cases: p1's ruid equals p2's ruid p1's euid equals p2's ruid p1's ruid equals p2's svuid p1's euid equals p2's svuid The P_SUGID and non-P_SUGID cases can now be largely collapsed, and I'll commit this in a few days if no immediate problems are encountered with this set of changes. o These changes remove a number of warning cases identified by the proc_to_proc inter-process authorization regression test. o As these are new restrictions, we'll have to watch out carefully for possible side effects on running code: they seem reasonable to me, but it's possible this change might have to be backed out if problems are experienced. Submitted by: src/tools/regression/security/proc_to_proc/testuid Reviewed by: tmm Obtained from: TrustedBSD Project
* o Disable two "allow this" exceptions in p_cansched()m retricting therwatson2001-04-121-1/+4
| | | | | | | | | | | | | | | | | | ability of unprivileged processes to modify the scheduling properties of daemons temporarily taking on unprivileged effective credentials. These cases (p1->p_cred->p_ruid == p2->p_ucred->cr_uid) and (p1->p_ucred->cr_uid == p2->p_ucred->cr_uid), respectively permitting a subject process to influence the scheduling of a daemon if the subject process has the same real uid or effective uid as the daemon's effective uid. This removes a number of the warning cases identified by the proc_to_proc iner-process authorization regression test. o As these are new restrictions, we'll have to watch out carefully for possible side effects on running code: they seem reasonable to me, but it's possible this change might have to be backed out if problems are experienced. Reported by: src/tools/regression/security/proc_to_proc/testuid Obtained from: TrustedBSD Project
* o Reduce information leakage into jails by adding invocations ofrwatson2001-04-121-0/+9
| | | | | | | | | p_can(...P_CAN_SEE...) to getpgid(), getsid(), and setpgid(), blocking these operations on processes that should not be visible by the requesting process. Required to reduce information leakage in MAC environments. Obtained from: TrustedBSD Project
* o Replace p_cankill() with p_cansignal(), remove wrappage of p_can()rwatson2001-04-121-32/+71
| | | | | | | | | | | | | | | | | | from signal authorization checking. o p_cansignal() takes three arguments: subject process, object process, and signal number, unlike p_cankill(), which only took into account the processes and not the signal number, improving the abstraction such that CANSIGNAL() from kern_sig.c can now also be eliminated; previously CANSIGNAL() special-cased the handling of SIGCONT based on process session. privused is now deprecated. o The new p_cansignal() further limits the set of signals that may be delivered to processes with P_SUGID set, and restructures the access control check to allow it to be extended more easily. o These changes take into account work done by the OpenBSD Project, as well as by Robert Watson and Thomas Moestl on the TrustedBSD Project. Obtained from: TrustedBSD Project
* o Introduce a new system call, __setsugid(), which allows a process torwatson2001-04-111-0/+23
| | | | | | | | | | | | | | | | | toggle the P_SUGID bit explicitly, rather than relying on it being set implicitly by other protection and credential logic. This feature is introduced to support inter-process authorization regression testing by simplifying userland credential management allowing the easy isolation and reproduction of authorization events with specific security contexts. This feature is enabled only by "options REGRESSION" and is not intended to be used by applications. While the feature is not known to introduce security vulnerabilities, it does allow processes to enter previously inaccessible parts of the credential state machine, and is therefore disabled by default. It may not constitute a risk, and therefore in the future pending further analysis (and appropriate need) may become a published interface. Obtained from: TrustedBSD Project
* o Restructure privilege check associated with process visibility forrwatson2001-03-291-3/+1
| | | | | | | | | ps_showallprocs such that if superuser is present to override process hiding, the search falls through [to success]. When additional restrictions are placed on process visibility, such as MAC, new clauses will be placed above the return(0). Obtained from: TrustedBSD Project
OpenPOWER on IntegriCloud