mac_seeotheruids4
Simple policy controlling whether users see other users
Usage
To compile the policy into your kernel, place the following lines in your kernel configuration file:
options MAC options MAC_SEEOTHERUIDS
Alternately, to load the module at boot time, place the following line in your kernel configuration file:
options MAC
and in loader.conf(5):
mac_seeotheruids_load="YES"
Overview
The mac_seeotheruids policy module, when enabled, denies users to see processes or sockets owned by other users.
To enable mac_seeotheruids, set the sysctl OID security.mac.seeotheruids.enabled to 1.
To allow users to see processes and sockets owned by the same primary group, set the sysctl OID security.mac.seeotheruids.primarygroup_enabled to 1.
To allow processes with a specific group ID to be exempt from the policy, set the sysctl OID security.mac.seeotheruids.specificgid_enabled to 1, and security.mac.seeotheruids.specificgid to the group ID to be exempted.
Label Format
No labels are defined for mac_seeotheruids.