New cr_bsd_visible(): Whether BSD policies deny seeing subjects/objects

[olce]

Summary

This is a new helper function that leverages existing code: It calls
successively cr_canseeotheruids(), cr_canseeothergids() and cr_canseejailproc()
(as long as the previous didn't deny access). Will be used in a subsequent
commit.

[emaste]

sys/kern/kern_prot.c

1441

Please mention return values for consistency with other function comments in this file

[zlei]

sys/kern/kern_prot.c

1444

Naming is hard.
cr_bsd_visible() seems to be consistent with current naming.

[olce]

sys/kern/kern_prot.c

1444

Indeed.

The most important thing is that the name reflects that these are BSD-specific (actually, FreeBSD-specific, but anyway) security policies and that these affect object/subject visibility.

I considered naming the function cr_security_bsd_visibility so as to reference the sysctl security.bsd more explicitly, but then the name was longer and probably not more helpful than the short form to people that are not aware of the security.bsd nodes.

I'm not that pleased with the name, but it does the job and I couldn't come up with a better idea. Suggestions welcome.

[olce]

Some info about return codes.

[mhorne]

sys/kern/kern_prot.c

1444

I also think cr_bsd_visible() is very slightly better.

sys/sys/proc.h

1162

I think the comment is not so valuable here.

[olce]

Rename cr_bsd_visibility() to cr_bsd_visible().

[olce]

Mark as accepted again, since the only change is the rename: cr_bsd_visibility() to cr_bsd_visible().

[olce]

Fix context lines after update of D40626.

[olce]

Mark as accepted again, no diff change in the last update.