mirror of
https://git.FreeBSD.org/src.git
synced 2025-02-01 17:00:36 +00:00
1554ba03b6
This module allows controlled privilege escallation via mac labels securely associated with a process via mac_veriexec. There are over 700 PRIV_* but we can compress many of them into a single GBL_* thus constraining the size of gbl labels. The goal is to allow a daemon to run as an unprivileged process while still being able a set of privileged operations needed. We add APIs to libveriexec so that userland processes can check labels and an exec_script API that allows a suitably labeled process to run something like a python interpreter directly if necessary; overcomming the 'indirect' flag applied to the interpreter. Add -l option to sbin/veriexec to report labels. Reviewed by: stevek Sponsored by: Juniper Networks, Inc. Differential Revision: https://reviews.freebsd.org/D41431 |
||
|---|---|---|
| .. | ||
| Makefile | ||
| Makefile.depend | ||
| manifest_lexer.l | ||
| manifest_parser.y | ||
| veriexec.8 | ||
| veriexec.c | ||
| veriexec.h | ||