diff options
| author | Baptiste Daroussin <bapt@FreeBSD.org> | 2024-05-09 22:03:28 +0000 |
|---|---|---|
| committer | Baptiste Daroussin <bapt@FreeBSD.org> | 2024-05-22 12:01:41 +0000 |
| commit | 8aac90f18aef7c9eea906c3ff9a001ca7b94f375 (patch) | |
| tree | ffb10f6d22183188b199cbc09d074a64e8ed28d9 /sys/modules/mac_do | |
| parent | ac4ddc467bfe895e965ed18e8b7bbbb4d7bf964d (diff) | |
mac_do: add a new MAC/do policy and mdo(1) utility
This policy enables a user to become another user without having to be
root (hence no setuid binary). it is configured via rules using sysctl
security.mac.do.rules
For example:
security.mac.do.rules=uid=1001:80,gid=0:any
The above rule means the user identifier by the uid 1001 is able to
become user 80
Any user of the group 0 are allowed to become any user on the system.
The mdo(1) utility expects the MAC/do policy to be installed and its
rules defined.
Reviewed by: des
Differential Revision: https://reviews.freebsd.org/D45145
Diffstat (limited to 'sys/modules/mac_do')
| -rw-r--r-- | sys/modules/mac_do/Makefile | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/sys/modules/mac_do/Makefile b/sys/modules/mac_do/Makefile new file mode 100644 index 000000000000..532a5b9faa71 --- /dev/null +++ b/sys/modules/mac_do/Makefile @@ -0,0 +1,6 @@ +.PATH: ${SRCTOP}/sys/security/mac_do + +KMOD= mac_do +SRCS= mac_do.c vnode_if.h + +.include <bsd.kmod.mk> |