summaryrefslogtreecommitdiff
path: root/share/examples/secmodel/secmodel_example.c
diff options
context:
space:
mode:
authorelad <elad@NetBSD.org>2006-12-14 11:45:08 +0000
committerelad <elad@NetBSD.org>2006-12-14 11:45:08 +0000
commit238ad51d2dc0a4ecb0de1aace73465418d1dcd2a (patch)
tree43be82def228f9b90344779e478488e0bfb78bbd /share/examples/secmodel/secmodel_example.c
parentaa4d8a2d6caf3e39503b44d040cfbc0a41480191 (diff)
- moves 'nice' access semantics to secmodel code,
- makes sysctl_proc_find() just lookup the process, - use KAUTH_PROCESS_CANSEE requests to determine if the caller is allowed to view the target process' corename, stop flags, and rlimits, - use explicit kauth(9) calls with KAUTH_PROCESS_CORENAME, KAUTH_REQ_PROCESS_RESOURCE_NICE, KAUTH_REQ_PROCESS_RESOURCE_RLIMIT, and KAUTH_PROCESS_STOPFLAG when modifying the aforementioned. - sync man-page and example skeleton secmodel with reality. okay yamt@ this is a pullup candidate.
Diffstat (limited to 'share/examples/secmodel/secmodel_example.c')
-rw-r--r--share/examples/secmodel/secmodel_example.c15
1 files changed, 10 insertions, 5 deletions
diff --git a/share/examples/secmodel/secmodel_example.c b/share/examples/secmodel/secmodel_example.c
index 38d6a0a836d..744d28826bd 100644
--- a/share/examples/secmodel/secmodel_example.c
+++ b/share/examples/secmodel/secmodel_example.c
@@ -1,4 +1,4 @@
-/* $NetBSD: secmodel_example.c,v 1.7 2006/11/22 12:12:51 elad Exp $ */
+/* $NetBSD: secmodel_example.c,v 1.8 2006/12/14 11:45:08 elad Exp $ */
/*
* This file is placed in the public domain.
@@ -13,7 +13,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: secmodel_example.c,v 1.7 2006/11/22 12:12:51 elad Exp $");
+__KERNEL_RCSID(0, "$NetBSD: secmodel_example.c,v 1.8 2006/12/14 11:45:08 elad Exp $");
#include <sys/types.h>
#include <sys/param.h>
@@ -211,6 +211,13 @@ secmodel_example_process_cb(kauth_cred_t cred, kauth_action_t action,
result = KAUTH_RESULT_DENY;
switch (action) {
+ case KAUTH_PROCESS_CANPROCFS:
+ case KAUTH_PROCESS_CANSEE:
+ case KAUTH_PROCESS_CANSIGNAL:
+ case KAUTH_PROCESS_CANSYSTRACE:
+ case KAUTH_PROCESS_CANPTRACE:
+ case KAUTH_PROCESS_CORENAME:
+ break;
case KAUTH_PROCESS_RESOURCE:
switch((u_long)arg0) {
case KAUTH_REQ_PROCESS_RESOURCE_NICE:
@@ -222,9 +229,7 @@ secmodel_example_process_cb(kauth_cred_t cred, kauth_action_t action,
break;
case KAUTH_PROCESS_SETID:
- case KAUTH_PROCESS_CANSEE:
- case KAUTH_PROCESS_CANSIGNAL:
- case KAUTH_PROCESS_CORENAME:
+ case KAUTH_PROCESS_STOPFLAG:
default:
result = KAUTH_RESULT_DEFER;
break;