NAME
cr_canseeotheruids —
determine if subjects may see entities
with differing user ID
SYNOPSIS
int
cr_canseeotheruids(struct
ucred *u1, struct ucred
*u2);
DESCRIPTION
This function checks if a subject associated to credentials u1 is denied seeing a subject or object associated to credentials u2 by a policy that requires both credentials to have the same real user ID.
This policy is active if and only if the sysctl(8) variable security.bsd.see_other_uids is set to zero.
As usual, the superuser (effective user ID 0) is exempt from this policy provided that the sysctl(8) variable security.bsd.suser_enabled is non-zero and no active MAC policy explicitly denies the exemption (see priv_check_cred(9)).
RETURN VALUES
The cr_canseeotheruids() function returns
0 if the policy is disabled, both credentials have the same real user ID, or
if u1 has privilege exempting it from the policy.
Otherwise, it returns ESRCH.