Date: Thu, 28 May 2009 08:12:52 -0400 From: John Baldwin <jhb@freebsd.org> To: freebsd-arch@freebsd.org Cc: Zachary Loafman <zml@freebsd.org>, steven.danneman@isilon.com, Sujit K M <kmsujit@gmail.com> Subject: Re: pthread_setugid_np Message-ID: <200905280812.52431.jhb@freebsd.org> In-Reply-To: <74fe56020905272148q680cdc05tb572d576a4c3ff2b@mail.gmail.com> References: <20090528000147.GB3704@isilon.com> <74fe56020905272133r3f2ab491t962c6d0fe900e9d0@mail.gmail.com> <74fe56020905272148q680cdc05tb572d576a4c3ff2b@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thursday 28 May 2009 12:48:17 am Sujit K M wrote: > As per the Apple Documentation: > > In some cases it is helpful to impersonate the user, at least as far > as the permissions checking done by the BSD subsystem of the kernel. A > single-threaded daemon can do this using seteuid and setegid. These > set the effective user and group ID of the process as a whole. This > will cause problems if your daemon is using multiple threads to handle > requests from different users. In that case you can set the effective > user and group ID of a thread using pthread_setugid_np. This was > introduced in Mac OS X 10.4. > > (AT) http://developer.apple.com/technotes/tn2005/tn2083.html > > > I think this is a part of the BSD (Mach) subsystem. It has never been in BSD outside of OS X. BSD from UC Berkeley did not support kernel threads and you are free to check the CVS history of the various kern_prot.c files on other BSD's yourself. There is no BSD code to do this, and you could not use Darwin's code directly on FreeBSD anyway since the two OS's manage credential state differently. -- John Baldwin
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200905280812.52431.jhb>