[ новости /+++ | форум | теги | ]

NAME

mac_seeotheruids

 - simple policy controlling whether users see other users

 

SYNOPSIS

options MAC options MAC_SEEOTHERUIDS

Alternately, to load the module at boot time, place the following line in your kernel configuration file:

options MAC

and in loader.conf5:

mac_seeotheruids_load="YES"

DESCRIPTION

To enable , set the sysctl OID security.mac.seeotheruids.enabled to 1. To permit superuser awareness of other credentials by virtue of privilege, set the sysctl OID security.mac.seeotheruids.suser_privileged to 1.

To allow users to see processes and sockets owned by the same primary group, set the sysctl OID security.mac.seeotheruids.primarygroup_enabled to 1.

To allow processes with a specific group ID to be exempt from the policy, set the sysctl OID security.mac.seeotheruids.specificgid_enabled to 1, and security.mac.seeotheruids.specificgid to the group ID to be exempted.  

Label Format

SEE ALSO

HISTORY

AUTHORS

BUGS

While the MAC Framework design is intended to support the containment of the root user, not all attack channels are currently protected by entry point checks. As such, MAC Framework policies should not be relied on, in isolation, to protect against a malicious privileged user.

Index

NAME

SYNOPSIS

DESCRIPTION

Label Format

SEE ALSO

HISTORY

AUTHORS

BUGS

Партнёры:

Хостинг: