CR_CANSEEOTHERUIDS(9)

📦 version 15.1, in freebsd 14.5, freebsd 15.1, nixpkgs unstable

💅 CR_CANSEEOTHERUIDS(9) 💅

okay so this page is from the Kernel Developer's Manual, section 9, and it's giving “internal credential vibe check” energy. Bestie, if you're here, you're probably deep in kernel-land, so let's go. 🦋

🌸 NAME 🌸

cr_canseeotheruids — determine if subjects may see entities with differing user ID 💖

✨ SYNOPSIS ✨

int
cr_canseeotheruids(struct ucred *u1, struct ucred *u2);

🦋 DESCRIPTION 🦋

This function is internal. 🚨 Like, for real: its functionality is integrated into the function cr_bsd_visible(9), which should be called instead. So if you were about to call this one directly, bestie, redirect that energy.

What it actually does: this function checks if a subject associated to credentials u1 is denied seeing a subject or object associated to credentials u2 by a policy that requires both credentials to have the same real user ID.

This policy is active if and only if the sysctl(8) variable security.bsd.see_other_uids is set to zero. 🫶

As usual, the superuser (effective user ID 0) is exempt from this policy provided that the sysctl(8) variable security.bsd.suser_enabled is non-zero and no active MAC policy explicitly denies the exemption (see priv_check_cred(9)). 👑

🔥 RETURN VALUES 🔥

The cr_canseeotheruids() function returns:

  • 0 — if the policy is disabled, both credentials have the same real user ID, or if u1 has privilege exempting it from the policy. ✨
  • ESRCH — otherwise. 😭

👑 SEE ALSO 👑

mwah 💋 this iconic little page is brought to you by Debian, dated August 18, 2023 — CR_CANSEEOTHERUIDS(9) girlies, stay visible only when the policy says so. 🎀

📦 where this page comes from