SECMODEL_EXTENSIONS(9)

📦 version 11.0, in nixpkgs unstable

💖 SECMODEL_EXTENSIONS(9) — Kernel Developer's Manual 💖

okay so bestie, welcome to the secmodel_extensions(9) page from the Kernel Developer's Manual 🫶 it's literally all about the extensions security model, and yes it's giving main character energy in the kernel ✨

🌸 NAME 🌸

secmodel_extensions — extensions security model 💅

✨ DESCRIPTION ✨

so secmodel_extensions implements extensions to the traditional security model based on the original 4.4BSD 🌈 they can be used to grant additional privileges to ordinary users, or enable specific security measures like curtain mode. no cap.

the extensions are described below, bestie 👇

🎀 Curtain mode 🎀

when enabled, all returned objects will be filtered according to the user-id requesting information about them, preventing users from accessing objects they do not own 💅 periodt.

it affects the output of many commands, including fstat(1), netstat(1), ps(1), sockstat(1), and w(1) 👑 not me checking my own processes and getting filtered, iykyk.

this extension is enabled by setting security.models.extensions.curtain or security.curtain (sysctl(7)) to a non-zero value ✨

it can be enabled at any time, but cannot be disabled anymore when the securelevel of the system is above 0 😭

vibe check bestie: once that securelevel is above 0, this one is staying on — no take-backs 💀

🦋 Non-superuser mounts 🦋

when enabled, it allows file-systems to be mounted by an ordinary user who owns the point node and has at least read access to the special device mount(8) arguments 🫶 note that the nosuid and nodev flags must be given for non-superuser mounts.

this extension is enabled by setting security.models.extensions.usermount or vfs.generic.usermount (sysctl(7)) to a non-zero value 🌟

it can be disabled at any time, but cannot be enabled anymore when the securelevel of the system is above 0 💀

another securelevel check, bestie: above 0, you cannot turn this one on anymore 🙈

🌈 Non-superuser control of CPU sets 🌈

when enabled, an ordinary user is allowed to control the CPU affinity(3) of the processes and threads they own 🧚 slay.

this extension is enabled by setting security.models.extensions.user_set_cpu_affinity (sysctl(7)) to a non-zero value 💜

it can be disabled at any time, but cannot be enabled anymore when the securelevel of the system is above 0 😭

same securelevel vibe: above 0, enabling is off the table, fr fr 🫠

prevent hardlinks to files that the user does not own or has group access to 🛑 the way that this blocks hardlinks is honestly iconic.

to enable user ownership checks, set the sysctl(7) variable security.models.extensions.hardlink_check_uid to a non-zero value ⭐

to enable group membership checks, set the sysctl(7) variable security.models.extensions.hardlink_check_gid to a non-zero value ⭐

these variables can be enabled anytime, but cannot be disabled anymore when the securelevel of the system is above 0 😭

securelevel above 0 = no turning these off anymore, bestie 💅

👀 SEE ALSO 👀

affinity(3), sched(3), sysctl(7), kauth(9), secmodel(9), secmodel_bsd44(9), secmodel_securelevel(9), secmodel_suser(9)

🫶 AUTHORS 🫶

Elad Efrat <elad@NetBSD.org>

kisses 💋 — this one came from Debian, dated March 27, 2022. mwah, bestie 🎀

📦 where this page comes from