KekenoBSD/src
3
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

MAC/bsdextended: Restore matching subjects' effective GID

Browse Source 
Fixes:          be1f7435ef ("kern: start tracking cr_gid outside of cr_groups[]")
MFC after:      5 days
MFC to:         stable/15
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D52270
This commit is contained in:
Olivier Certner
2025-08-27 16:56:21 +02:00
parent 0abeb8d8d8
commit ab7186a486
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
sys/security/mac_bsdextended/mac_bsdextended.c
+3 -1
View File
@@ -246,7 +246,9 @@ ugidfw_rulecheck(struct mac_bsdextended_rule *rule,
}
if (rule->mbr_subject.mbs_flags & MBS_GID_DEFINED) {
match = ((cred->cr_rgid <= rule->mbr_subject.mbs_gid_max &&
match = ((cred->cr_gid <= rule->mbr_subject.mbs_gid_max &&
cred->cr_gid >= rule->mbr_subject.mbs_gid_min) ||
(cred->cr_rgid <= rule->mbr_subject.mbs_gid_max &&
cred->cr_rgid >= rule->mbr_subject.mbs_gid_min) ||
(cred->cr_svgid <= rule->mbr_subject.mbs_gid_max &&
cred->cr_svgid >= rule->mbr_subject.mbs_gid_min));