KekenoBSD/src
3
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

MAC/do: Fix reporting of "mac.do" post-"executable paths"

Browse Source 
In mac_do_jail_get(), computation of 'jsys' had not been updated to take
into account executable paths.

Reviewed by:    bapt
Fixes:          9818224174 ("MAC/do: Executable paths feature (GSoC 2025's final state)")
MFC after:      1 month
Sponsored by:   The FreeBSD Foundation
Pull Request:   https://ron-dev.freebsd.org/FreeBSD/src/pulls/38
This commit is contained in:
Olivier Certner
2026-04-28 15:17:18 +02:00
parent 51cc5840b6
commit 888a84ceed
1 changed files with 2 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
sys/security/mac_do/mac_do.c
+2 -3
View File
@@ -1560,9 +1560,8 @@ mac_do_jail_get(void *obj, void *data)
const struct exec_paths *const exec_paths = &applicable_conf->exec_paths;
int jsys, error;
jsys = hpr == pr ?
(STAILQ_EMPTY(&rules->head) ? JAIL_SYS_DISABLE : JAIL_SYS_NEW) :
JAIL_SYS_INHERIT;
jsys = hpr == pr ? (has_rules(rules) && has_exec_paths(exec_paths) ?
JAIL_SYS_NEW : JAIL_SYS_DISABLE) : JAIL_SYS_INHERIT;
error = vfs_setopt(opts, "mac.do", &jsys, sizeof(jsys));
if (error != 0 && error != ENOENT)