Add pledge "id" support. This request permits setuid/seteuid/setresuid,
authorderaadt <deraadt@openbsd.org>
Sat, 17 Oct 2015 04:31:07 +0000 (04:31 +0000)
committerderaadt <deraadt@openbsd.org>
Sat, 17 Oct 2015 04:31:07 +0000 (04:31 +0000)
commit92d83454194f6e8bf6a66e14c5926ee8ce711e32
tree1a0e81924049403b03fd0250fc08bf7bfb01a620
parent90b2ad0c1df33f5cda3a6bf23b4b5b84122c2745
Add pledge "id" support.  This request permits setuid/seteuid/setresuid,
setgid/setegid/setresgid, setgroups, setlogin, and setpriority.

setrlimit and getpriority are also allowed (they are also in "proc")

some of these were previously permitted in "proc" but have been removed.
this seperation is intentional.  "proc" is intended for reasoning about
the relationship of a process "with other processes", whereas "id" deals
the powerful/dangerous concept of unix ids.  "id" will see some action
very soon.

ok gilles tedu semarie doug
sys/kern/kern_pledge.c
sys/sys/pledge.h