CR_CANSEE(9)

💖 CR_CANSEE(9) 💖

okay bestie, this is CR_CANSEE(9) from the Kernel Developer's Manual — section 9, kernel dev territory, and it's literally about deciding whether one credential can “see” another subject or object. No cap. 👑

---

🌸 NAME 🌸

cr_cansee — determine visibility of objects given their user credentials

---

✨ SYNOPSIS ✨

#include <sys/proc.h>

int
cr_cansee(struct ucred *u1, struct ucred *u2);

---

🦋 DESCRIPTION 🦋

Okay so picture this: this function determines if a subject with credential u1 can see a subject or object associated to credential u2. That's it. That's the whole plot — visibility, but for creds. 👀

Specific types of subjects may need to submit to additional or different restrictions. As an example, for processes, see p_cansee(9), which calls this function. So if you're here from process land, that's your next stop. 🫶

The implementation relies on cr_bsd_visible(9), and consequently the sysctl(8) variables referenced in its manual page influence the result. Highkey important: those sysctls are part of the vibe. ✨

---

🎀 RETURN VALUES 🎀

This function returns zero if the subject with credential u1 can “see” the subject or object with credential u2. Otherwise it returns ESRCH. That's the whole vibe check: 0 means visible, ESRCH means nope. 💅

---

🔥 ERRORS 🔥

• [ESRCH] — The subject with credential u1 has been jailed and the subject or object with credential u2 does not belong to the same jail or one of its sub-jails, as determined by prison_check(9). 🚔
• [ESRCH] — The MAC subsystem denied visibility.
• [ESRCH] — cr_bsd_visible(9) denied visibility according to the BSD security policies in force.

---

🌈 SEE ALSO 🌈

Go read these, bestie: cr_bsd_visible(9), mac(9), p_cansee(9), prison_check(9). iykyk 💜

---

xoxo, this page is from Debian, dated August 18, 2023 — CR_CANSEE(9) signing off 💅💖