CR_CANSEEOTHERGIDS(9)

💅 CR_CANSEEOTHERGIDS(9) — the kernel dev manual, bestie edition ✨

okay so this is a page from the Kernel Developer's Manual (section 9, kernel functions, iykyk) and honestly? it's giving "internal helper energy" but we're gonna learn it anyway because that's what besties do 🫶

---

🎀 NAME 🎀

cr_canseeothergids — the little function that decides whether subjects are allowed to see entities that live in a totally disjoint group set 💀

---

✨ SYNOPSIS ✨

int
cr_canseeothergids(struct ucred *u1, struct ucred *u2);

like, two credential pointers in, one int out. simple. iconic. no notes. 👑

---

🌸 DESCRIPTION 🌸

so first thing first, bestie: this function is internal. it's not a main character, it's a supporting character 😭. its whole functionality is integrated into the function cr_bsd_visible(9), and like — that's the one you should actually be calling instead. fr fr. don't @ me.

what it does do: it checks whether a subject associated with credentials u1 is denied from seeing a subject or object associated with credentials u2, according to a policy that says both credentials have to share at least one group in common 🫂. if they don't share a group, the seeing gets denied.

for this determination, the real and supplementary group IDs are used — but not the effective group IDs, as per realgroupmember(9). the way that effective gids are just... not invited to this party 🙈

and when does this policy even kick in? it's active if and only if the sysctl(8) variable security.bsd.see_other_gids is set to zero. that's it. that's the switch. ✨

also, as usual, the superuser (effective user ID 0) is exempt from this policy — provided that:

• the sysctl(8) variable security.bsd.suser_enabled is non-zero, and
• no active MAC policy explicitly denies the exemption (see priv_check_cred(9))

⚠️ note the "provided that" bestie — root isn't automatically free, the exemption has to actually be live and not blocked by MAC. read the fine print, it's giving ✨conditions apply✨

---

💖 RETURN VALUES 💖

cr_canseeothergids() returns 0 if any of these slay conditions are true:

• the policy is disabled, or
• the credentials share at least one common group, or
• u1 has a privilege that exempts it from the policy 👑

otherwise? it returns ESRCH. that's the "nope, denied, blocked, go home" 💀

---

🦋 SEE ALSO 🦋

• cr_bsd_visible(9)
• priv_check_cred(9)
• realgroupmember(9)

---

and that's the page!! 🌈 this one shipped from Debian, dated August 18, 2023 — so yeah, credit where credit's due, mwah 💋 go call cr_bsd_visible(9) like I told you, and stay hydrated 🍓🧚💜