priv: Narrow down privileges

diff --git a/sys/kern/kern_resource.c b/sys/kern/kern_resource.c
index 1f69bbb..32b5706 100644 (file)
--- a/sys/kern/kern_resource.c
+++ b/sys/kern/kern_resource.c
@@ -256,7 +256,7 @@ donice(struct proc *chgp, int n)
                n = PRIO_MAX;
        if (n < PRIO_MIN)
                n = PRIO_MIN;
-       if (n < chgp->p_nice && priv_check_cred(cr, PRIV_ROOT, 0))
+       if (n < chgp->p_nice && priv_check_cred(cr, PRIV_SCHED_SETPRIORITY, 0))
                return (EACCES);
        chgp->p_nice = n;
        FOREACH_LWP_IN_PROC(lp, chgp)
@@ -314,7 +314,7 @@ sys_lwp_rtprio(struct lwp_rtprio_args *uap)
                        return EPERM;
                }
                /* disallow setting rtprio in most cases if not superuser */
-               if (priv_check_cred(cr, PRIV_ROOT, 0)) {
+               if (priv_check_cred(cr, PRIV_SCHED_RTPRIO, 0)) {
                        /* can't set someone else's */
                        if (uap->pid) { /* XXX */
                                return EPERM;
@@ -388,7 +388,7 @@ sys_rtprio(struct rtprio_args *uap)
                    cr->cr_ruid != p->p_ucred->cr_uid)
                        return (EPERM);
                /* disallow setting rtprio in most cases if not superuser */
-               if (priv_check_cred(cr, PRIV_ROOT, 0)) {
+               if (priv_check_cred(cr, PRIV_SCHED_RTPRIO, 0)) {
                        /* can't set someone else's */
                        if (uap->pid)
                                return (EPERM);

diff --git a/sys/kern/kern_shutdown.c b/sys/kern/kern_shutdown.c
index 2e87eb7..41b352c 100644 (file)
--- a/sys/kern/kern_shutdown.c
+++ b/sys/kern/kern_shutdown.c
@@ -186,7 +186,7 @@ sys_reboot(struct reboot_args *uap)
        struct thread *td = curthread;
        int error;
 
-       if ((error = priv_check(td, PRIV_ROOT)))
+       if ((error = priv_check(td, PRIV_REBOOT)))
                return (error);
 
        boot(uap->opt);

diff --git a/sys/kern/kern_sysctl.c b/sys/kern/kern_sysctl.c
index 0838c6b..72524c4 100644 (file)
--- a/sys/kern/kern_sysctl.c
+++ b/sys/kern/kern_sysctl.c
@@ -536,7 +536,7 @@ sysctl_sysctl_debug(SYSCTL_HANDLER_ARGS)
 {
        int error;
 
-       error = priv_check(req->td, PRIV_ROOT);
+       error = priv_check(req->td, PRIV_SYSCTL_DEBUG);
        if (error)
                return error;
        sysctl_sysctl_debug_dump_node(&sysctl__children, 0);