Subject: Re: kern.showallprocs implementation
To: Rui Paulo <alpha1@freeshell.org>
From: Wolfgang Solfrank <ws@tools.de>
List: tech-security
Date: 06/27/2004 18:15:08
Hi,

> +                /*
> +	 	 * If kern.showallprocs == 0, then skip processes that don't 
> +		 * match the UID of the calling process. Root is allowed to 
> +		 * see every process.
> +		 */
> +		
> +		if (!showallprocs && 
> +		    suser(l->l_proc->p_ucred, &l->l_proc->p_acflag) &&
> +		    p->p_ucred->cr_uid != l->l_proc->p_ucred->cr_uid)
> +			continue;

Note that you should do the suser() call only after being sure
that you need root priviledges here, i.e. first compare the
uids, then call suser().  The subtle difference being that
p_acflag records the fact that superuser priviledges were
neccessary for the process.

Ciao,
Wolfgang
-- 
ws@TooLs.DE     Wolfgang Solfrank, TooLs GmbH 	+49-228-985800