tail head cat sleep
QR code linking to this page
Main index Section 9
Go to:
Options

Manual Pages  — CR_CANSEEOTHERUIDS

NAME

cr_canseeotheruids – determine if subjects may see entities with differing user ID

CONTENTS

SYNOPSIS


int
cr_canseeotheruids(struct ucred *u1, struct ucred *u2);

DESCRIPTION

This function is internal. Its functionality is integrated into the function cr_bsd_visible(9), which should be called instead.

This function checks if a subject associated to credentials u1 is denied seeing a subject or object associated to credentials u2 by a policy that requires both credentials to have the same real user ID.

This policy is active if and only if the sysctl(8) variable security.bsd.see_other_uids is set to zero.

As usual, the superuser (effective user ID 0) is exempt from this policy provided that the sysctl(8) variable security.bsd.suser_enabled is non-zero and no active MAC policy explicitly denies the exemption ( see priv_check_cred(9) ).

RETURN VALUES

The cr_canseeotheruids() function returns 0 if the policy is disabled, both credentials have the same real user ID, or if u1 has privilege exempting it from the policy. Otherwise, it returns ESRCH.

SEE ALSO

cr_bsd_visible(9), priv_check_cred(9)
CR_CANSEEOTHERUIDS (9) August 18, 2023
tail head cat sleep
QR code linking to this page
Main index Section 9
Go to:
Options

Please direct any comments about this manual page service to Ben Bullock. Privacy policy.

“ I'm not interested in developing a powerful brain. All I'm after is just a mediocre brain, something like the President of the American Telephone and Telegraph Company. ”
— Alan Turing