HomeFreeBSD

mac_do: add a new MAC/do policy and mdo(1) utility

Description

mac_do: add a new MAC/do policy and mdo(1) utility

This policy enables a user to become another user without having to be
root (hence no setuid binary). it is configured via rules using sysctl
security.mac.do.rules

For example:
security.mac.do.rules=uid=1001:80,gid=0:any

The above rule means the user identifier by the uid 1001 is able to
become user 80
Any user of the group 0 are allowed to become any user on the system.

The mdo(1) utility expects the MAC/do policy to be installed and its
rules defined.

Reviewed by: des
Differential Revision: https://reviews.freebsd.org/D45145

(cherry picked from commit 8aac90f18aef7c9eea906c3ff9a001ca7b94f375)

Details

Provenance
baptAuthored on May 9 2024, 10:03 PM
Reviewer
des
Differential Revision
D45145: mac_do: add a new MAC/do policy and mdo(1) utility
Parents
rG2472e352d80f: icmp: correct the assertion that checks limit + jitter
Branches
Unknown
Tags
Unknown