diff options
| author | Baptiste Daroussin <bapt@FreeBSD.org> | 2024-05-09 22:03:28 +0000 |
|---|---|---|
| committer | Baptiste Daroussin <bapt@FreeBSD.org> | 2024-05-22 12:01:41 +0000 |
| commit | 8aac90f18aef7c9eea906c3ff9a001ca7b94f375 (patch) | |
| tree | ffb10f6d22183188b199cbc09d074a64e8ed28d9 /sys/modules | |
| parent | ac4ddc467bfe895e965ed18e8b7bbbb4d7bf964d (diff) | |
mac_do: add a new MAC/do policy and mdo(1) utility
This policy enables a user to become another user without having to be
root (hence no setuid binary). it is configured via rules using sysctl
security.mac.do.rules
For example:
security.mac.do.rules=uid=1001:80,gid=0:any
The above rule means the user identifier by the uid 1001 is able to
become user 80
Any user of the group 0 are allowed to become any user on the system.
The mdo(1) utility expects the MAC/do policy to be installed and its
rules defined.
Reviewed by: des
Differential Revision: https://reviews.freebsd.org/D45145
Diffstat (limited to 'sys/modules')
| -rw-r--r-- | sys/modules/Makefile | 2 | ||||
| -rw-r--r-- | sys/modules/mac_do/Makefile | 6 |
2 files changed, 8 insertions, 0 deletions
diff --git a/sys/modules/Makefile b/sys/modules/Makefile index 2bd8914ab0d5..ad274e7f7b47 100644 --- a/sys/modules/Makefile +++ b/sys/modules/Makefile @@ -226,6 +226,7 @@ SUBDIR= \ ${_mac_biba} \ ${_mac_bsdextended} \ ${_mac_ddb} \ + ${_mac_do} \ ${_mac_ifoff} \ ${_mac_ipacl} \ ${_mac_lomac} \ @@ -587,6 +588,7 @@ _mac_bsdextended= mac_bsdextended .if ${KERN_OPTS:MDDB} || defined(ALL_MODULES) _mac_ddb= mac_ddb .endif +_mac_do= mac_do _mac_ifoff= mac_ifoff _mac_ipacl= mac_ipacl _mac_lomac= mac_lomac diff --git a/sys/modules/mac_do/Makefile b/sys/modules/mac_do/Makefile new file mode 100644 index 000000000000..532a5b9faa71 --- /dev/null +++ b/sys/modules/mac_do/Makefile @@ -0,0 +1,6 @@ +.PATH: ${SRCTOP}/sys/security/mac_do + +KMOD= mac_do +SRCS= mac_do.c vnode_if.h + +.include <bsd.kmod.mk> |