MAC/do: Restore matching the first supplementary group

As 'cr_gid' was in fact stored in cr_groups[0],
rule_grant_supplementary_groups() would loop only on further elements of
cr_groups[].  Now that cr_groups[0] is not 'cr_gid' anymore, but some
supplementary group, take it into account.

Fixes:          be1f7435ef ("kern: start tracking cr_gid outside of cr_groups[]")
MFC after:      5 days
MFC to:         stable/15
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D52271

This commit is contained in:

Olivier Certner

2025-08-27 17:22:26 +02:00

parent ab7186a486

commit d39756f23f

1 changed files with 1 additions and 1 deletions

									
										sys/security/mac_do/mac_do.c
									
		+1
		-1
	
												View File
												
				@@ -1650,7 +1650,7 @@ rule_grant_supplementary_groups(const struct rule *const rule,

					const bool current_has_supp = (gid_flags & MDF_CURRENT) != 0 &&

					    (gid_flags & MDF_SUPP_MASK) != 0;

					id_nb_t rule_idx = 0;

					int old_idx = 1, new_idx = 1;

					int old_idx = 0, new_idx = 0;

					if ((gid_flags & MDF_ANY_SUPP) != 0 &&

					    (gid_flags & MDF_MAY_REJ_SUPP) == 0)