diff options
| author | elad <elad@NetBSD.org> | 2006-12-14 11:45:08 +0000 |
|---|---|---|
| committer | elad <elad@NetBSD.org> | 2006-12-14 11:45:08 +0000 |
| commit | 238ad51d2dc0a4ecb0de1aace73465418d1dcd2a (patch) | |
| tree | 43be82def228f9b90344779e478488e0bfb78bbd /share/examples/secmodel/secmodel_example.c | |
| parent | aa4d8a2d6caf3e39503b44d040cfbc0a41480191 (diff) | |
- moves 'nice' access semantics to secmodel code,
- makes sysctl_proc_find() just lookup the process,
- use KAUTH_PROCESS_CANSEE requests to determine if the caller is
allowed to view the target process' corename, stop flags, and
rlimits,
- use explicit kauth(9) calls with KAUTH_PROCESS_CORENAME,
KAUTH_REQ_PROCESS_RESOURCE_NICE, KAUTH_REQ_PROCESS_RESOURCE_RLIMIT,
and KAUTH_PROCESS_STOPFLAG when modifying the aforementioned.
- sync man-page and example skeleton secmodel with reality.
okay yamt@
this is a pullup candidate.
Diffstat (limited to 'share/examples/secmodel/secmodel_example.c')
| -rw-r--r-- | share/examples/secmodel/secmodel_example.c | 15 |
1 files changed, 10 insertions, 5 deletions
diff --git a/share/examples/secmodel/secmodel_example.c b/share/examples/secmodel/secmodel_example.c index 38d6a0a836d..744d28826bd 100644 --- a/share/examples/secmodel/secmodel_example.c +++ b/share/examples/secmodel/secmodel_example.c @@ -1,4 +1,4 @@ -/* $NetBSD: secmodel_example.c,v 1.7 2006/11/22 12:12:51 elad Exp $ */ +/* $NetBSD: secmodel_example.c,v 1.8 2006/12/14 11:45:08 elad Exp $ */ /* * This file is placed in the public domain. @@ -13,7 +13,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: secmodel_example.c,v 1.7 2006/11/22 12:12:51 elad Exp $"); +__KERNEL_RCSID(0, "$NetBSD: secmodel_example.c,v 1.8 2006/12/14 11:45:08 elad Exp $"); #include <sys/types.h> #include <sys/param.h> @@ -211,6 +211,13 @@ secmodel_example_process_cb(kauth_cred_t cred, kauth_action_t action, result = KAUTH_RESULT_DENY; switch (action) { + case KAUTH_PROCESS_CANPROCFS: + case KAUTH_PROCESS_CANSEE: + case KAUTH_PROCESS_CANSIGNAL: + case KAUTH_PROCESS_CANSYSTRACE: + case KAUTH_PROCESS_CANPTRACE: + case KAUTH_PROCESS_CORENAME: + break; case KAUTH_PROCESS_RESOURCE: switch((u_long)arg0) { case KAUTH_REQ_PROCESS_RESOURCE_NICE: @@ -222,9 +229,7 @@ secmodel_example_process_cb(kauth_cred_t cred, kauth_action_t action, break; case KAUTH_PROCESS_SETID: - case KAUTH_PROCESS_CANSEE: - case KAUTH_PROCESS_CANSIGNAL: - case KAUTH_PROCESS_CORENAME: + case KAUTH_PROCESS_STOPFLAG: default: result = KAUTH_RESULT_DEFER; break; |
