kern/79705: mac_seeotheruids not blocking root

[Matthew Poole]

>Number:         79705
>Category:       kern
>Synopsis:       mac_seeotheruids not blocking root
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sat Apr 09 03:20:30 GMT 2005
>Closed-Date:
>Last-Modified:
>Originator:     Matthew Poole
>Release:        5.4-STABLE
>Organization:
>Environment:
FreeBSD ghengis.flat205 5.4-STABLE FreeBSD 5.4-STABLE #1: Sat Apr  9 01:15:59 NZST 2005     root at ghengis.flat205:/usr/obj/usr/src/sys/KERNEL.SECURE  i386
>Description:
Have loaded mac_seeotheruids, and confirmed that security.mac.seeotheruids.specificgid_enabled=0
However, root can still see all user processes.  Documentation indicates that root should not be able to see other users' processes if specificgid_enabled is set to 0.
>How-To-Repeat:
Build kernel with MAC
kldload mac_seeotheruids

Have users other than root logged in.

sysctl security.mac.seeotheruids.specificgid_enabled=0
ps wwaux | grep -v ^root
>Fix:

>Release-Note:
>Audit-Trail:
>Unformatted: