Re: how to deny reading of several sysctls (for a set of uids, f.e.)

2007-01-25 Thread Andrey V. Elsukov
Andrew N. Below wrote: I also thought about passing control variable from libc to kernel, but it seems to be bad idea. Any other ways? As an idea - maybe you can implement this feature as MAC module? Looks for a mac_check_system_sysctl function. -- WBR, Andrey V. Elsukov

Re: how to deny reading of several sysctls (for a set of uids, f.e.)

2007-01-24 Thread Andrew N. Below
On Tue, 23 Jan 2007 14:10:19 +0100 Max Laier [EMAIL PROTECTED] wrote: [..] td-td_proc-p_ucred has the user credentials. You probably want to do your checks in userland_sysctl() according to the comment just above. Thanks, it is really what I need. Now I have once more question. I made

Re: how to deny reading of several sysctls (for a set of uids, f.e.)

2007-01-24 Thread Max Laier
On Wednesday 24 January 2007 14:23, you wrote: On Tue, 23 Jan 2007 14:10:19 +0100 Max Laier [EMAIL PROTECTED] wrote: [..] td-td_proc-p_ucred has the user credentials. You probably want to do your checks in userland_sysctl() according to the comment just above. Thanks, it is really

Re: how to deny reading of several sysctls (for a set of uids, f.e.)

2007-01-24 Thread Andrew N. Below
Is there a documented possibility to use syscalls _inside_ kernel code? In other words, I need to call the function located in loadable kernel object from kernel, doesn't matter how this would be done (syscall, etc). Hi Andrew, You can redirect syscalls to another function with

RE: how to deny reading of several sysctls (for a set of uids, f.e.)

2007-01-24 Thread Thijs Eilander
Is there a documented possibility to use syscalls _inside_ kernel code? In other words, I need to call the function located in loadable kernel object from kernel, doesn't matter how this would be done (syscall, etc). Hi Andrew, You can redirect syscalls to another function with loadable

how to deny reading of several sysctls (for a set of uids, f.e.)

2007-01-23 Thread Andrew N. Below
Hello. System - RELENG_6. Easiest way I found is to patch libc. But in this case we still can get an original library and use LD_PRELOAD. Is there any way to obtain uid of calling process (thread?) within the kernel? We have following extern in src/lib/libc/gen/sysctl.c: [..] extern int

Re: how to deny reading of several sysctls (for a set of uids, f.e.)

2007-01-23 Thread Max Laier
On Tuesday 23 January 2007 12:44, Andrew N. Below wrote: System - RELENG_6. Easiest way I found is to patch libc. But in this case we still can get an original library and use LD_PRELOAD. Is there any way to obtain uid of calling process (thread?) within the kernel? We have following