priv: Introduce PRIV_VM_RESIDENT and use it

diff --git a/sys/kern/imgact_resident.c b/sys/kern/imgact_resident.c
index 6389c0e..769f1b2 100644 (file)
--- a/sys/kern/imgact_resident.c
+++ b/sys/kern/imgact_resident.c
@@ -133,7 +133,7 @@ sysctl_vm_resident(SYSCTL_HANDLER_ARGS)
 
        /* only super-user should call this sysctl */
        td = req->td;
-       if ((priv_check(td, PRIV_ROOT)) != 0)
+       if ((priv_check(td, PRIV_VM_RESIDENT)) != 0)
                return EPERM;
 
        error = count = 0;
@@ -185,7 +185,8 @@ exec_resident_imgact(struct image_params *imgp)
 /*
  * exec_sys_register(entry)
  *
- * Register ourselves for resident execution.  Only root can do this.  This
+ * Register ourselves for resident execution.  Only root (i.e. a process with
+ * PRIV_VM_RESIDENT credentials) can do this.  This
  * will snapshot the vmspace and cause future exec's of the specified binary
  * to use the snapshot directly rather then load & relocate a new copy.
  */
@@ -198,7 +199,7 @@ sys_exec_sys_register(struct exec_sys_register_args *uap)
     int error;
 
     p = curproc;
-    if ((error = priv_check_cred(p->p_ucred, PRIV_ROOT, 0)) != 0)
+    if ((error = priv_check_cred(p->p_ucred, PRIV_VM_RESIDENT, 0)) != 0)
        return(error);
     if ((vp = p->p_textvp) == NULL)
        return(ENOENT);
@@ -238,7 +239,7 @@ sys_exec_sys_unregister(struct exec_sys_unregister_args *uap)
     int count;
 
     p = curproc;
-    if ((error = priv_check_cred(p->p_ucred, PRIV_ROOT, 0)) != 0)
+    if ((error = priv_check_cred(p->p_ucred, PRIV_VM_RESIDENT, 0)) != 0)
        return(error);
 
     /*

diff --git a/sys/sys/priv.h b/sys/sys/priv.h
index 1d19441..128d9d5 100644 (file)
--- a/sys/sys/priv.h
+++ b/sys/sys/priv.h
@@ -286,6 +286,7 @@
 #define        PRIV_VM_MADV_PROTECT    360     /* Can set MADV_PROTECT. */
 #define        PRIV_VM_MLOCK           361     /* Can mlock(), mlockall(). */
 #define        PRIV_VM_MUNLOCK         362     /* Can munlock(), munlockall(). */
+#define PRIV_VM_RESIDENT        363     /* Can use resident(8) */
 
 /*
  * Device file system privileges.