exec: Add credential change information into imgp for process_exec hook.
authorbdrewery <bdrewery@FreeBSD.org>
Thu, 26 May 2016 23:18:54 +0000 (23:18 +0000)
committerbdrewery <bdrewery@FreeBSD.org>
Thu, 26 May 2016 23:18:54 +0000 (23:18 +0000)
commitecf7a0caee23c11e92ee375940ea5f0d88e4c81f
tree60012d70e2a28c645964f08f6595c84744bf60c4
parent8c87c3cb87bb9ab932965b629bc4eaf71f7de7cb
exec: Add credential change information into imgp for process_exec hook.

This allows an EVENTHANDLER(process_exec) hook to see if the new image
will cause credentials to change whether due to setgid/setuid or because
of POSIX saved-id semantics.

This adds 3 new fields into image_params:
  struct ucred *newcred Non-null if the credentials will change.
  bool credential_setid True if the new image is setuid or setgid.

This will pre-determine the new credentials before invoking the image
activators, where the process_exec hook is called.  The new credentials
will be installed into the process in the same place as before, after
image activators are done handling the image.

MFC after: 2 weeks
Reviewed by: kib
Sponsored by: EMC / Isilon Storage Division
Differential Revision: https://reviews.freebsd.org/D6544
sys/kern/kern_exec.c
sys/sys/imgact.h