CR_BSD_VISIBLE(9)

💅 CR_BSD_VISIBLE(9) — the kernel dev manual page, bestie edition 🎀

okay so real talk: this is a section 9 page from the Kernel Developer's Manual, and it's all about cr_bsd_visible — the little function that decides whether someone is even allowed to see you 👀. It's giving bouncer-at-the-club energy, fr fr.

---

✨ NAME ✨

cr_bsd_visible — figue out if subjects may see entities according to the BSD security policies 🕵️‍♀️

---

✨ SYNOPSIS ✨

#include <sys/proc.h>

int
cr_bsd_visible(struct ucred *u1, struct ucred *u2);

---

✨ DESCRIPTION ✨

So here's the tea 🍵: this function checks whether a subject holding credentials u1 is denied seeing an object or another subject that's associated with credentials u2. It runs that vibe check against these policies and their matching sysctl(8) knobs:

• security.bsd.seeotheruids — if this is set to 0, subjects literally cannot see other subjects or objects unless they're associated with the same real user ID. The internal function doing the work here is cr_canseeotheruids(9).
• security.bsd.seeothergids — if this is set to 0, subjects cannot see other subjects or objects unless they're both a member of at least one common group. The internal function responsible is cr_canseeothergids(9).
• security.bsd.see_jail_proc — if this is set to 0, subjects cannot see other subjects or objects that aren't associated with the same jail as them. The internal function behind it is cr_canseejailproc(9).

And as usual, the superuser (effective user ID 0) is exempt from any of these policies 👑 — provided the sysctl(8) variable security.bsd.suser_enabled is non-zero and no active MAC policy explicitly denies the exemption (peep priv_check_cred(9) for that).

This function is intended to be used as a helper to implement cr_cansee(9) and similar functions. It's the supporting character that absolutely ate 💅.

---

✨ RETURN VALUES ✨

It returns zero if a subject with credentials u1 may see a subject or object with credentials u2 according to the active above-mentioned policies. Otherwise? ESRCH. That's it, that's the answer 😭

---

✨ ERRORS ✨

• [ESRCH] — Credentials u1 and u2 do not have the same real user ID.
• [ESRCH] — Credentials u1 and u2 are not members of any common group (as determined by realgroupmember(9)).
• [ESRCH] — Credentials u1 and u2 are not in the same jail.

---

✨ SEE ALSO ✨

cr_cansee(9), cr_canseejailproc(9), cr_canseeothergids(9), cr_canseeotheruids(9), priv_check_cred(9)

---

✨ AUTHORS ✨

This function and its manual page were written by Olivier Certner <olce.freebsd@certner.fr>. iconic of him honestly 🫶

---

and that's the whole page, bestie — source is Debian, dated August 18, 2023, CR_BSD_VISIBLE(9). go forth and see (or don't see) other subjects 💖✨🦋