CR_CANSEEJAILPROC(9)

📦 version 15.1, in freebsd 14.5, freebsd 15.1, nixpkgs unstable

💅 CR_CANSEEJAILPROC(9) — the kernel dev manual, bestie edition 🎀

okay so this is a page straight out of the Kernel Developer's Manual, section 9, and it's all about one lil internal function. let's get into it ✨

🌸 NAME 🌸

cr_canseejailproc — figure out whether subjects are allowed to see entities chilling in sub-jails 👀

✨ SYNOPSIS ✨

int
cr_canseejailproc(struct ucred *u1, struct ucred *u2);

two credentials walk in, one function call comes out 🫶

💖 DESCRIPTION 💖

okay so first things first, bestie: this function is internal. like, it's not the main character you should be calling. its whole functionality got folded into cr_bsd_visible(9), and that's the one you should call instead. periodt.

so what does it actually do? it checks whether a subject associated with credentials u1 is denied seeing a subject or object associated with credentials u2, by a policy that requires both credentials to be associated with the same jail. it's giving gatekeeping, honestly.

quick context: the baseline jail policy says a subject can see subjects or objects in its own jail or any sub-jail of it. this policy here is a restriction on top of that baseline. strict vibes.

and when is this policy even active? literally only when the sysctl(8) variable security.bsd.see_jail_proc is set to zero. that's the switch, iykyk. 🔥

and as usual, the superuser — that's effective user ID 0 — is exempt from this policy, provided that the sysctl(8) variable security.bsd.suser_enabled is non-zero and no active MAC policy explicitly denies the exemption. peek priv_check_cred(9) for the deets on that one. 👑

🦋 RETURN VALUES 🦋

cr_canseejailproc() returns 0 when any of these iconic situations happen:

  • the policy is disabled, or
  • both credentials are associated with the same jail, or
  • u1 has a privilege that exempts it from the policy.

otherwise? it returns ESRCH. rude but fair 💀

🌈 SEE ALSO 🌈

go read these, bestie, they're the moment 🧚

👑 AUTHORS 👑

this manual page was written by Olivier Certner <olce.freebsd@certner.fr>. absolute icon, we stan 🫶

aaaand that's the page!! no cap, you now know everything this manpage knows 💜

sign-off time: this lil beauty comes from Debian, dated August 18, 2023, and lives in section 9 of the manual — CR_CANSEEJAILPROC(9), main character energy from start to finish ⭐🎀

📦 where this page comes from