Date: Wed, 17 Sep 2025 12:19:03 GMT From: Olivier Certner <olce@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Subject: git: ab7186a48634 - main - MAC/bsdextended: Restore matching subjects' effective GID Message-ID: <202509171219.58HCJ3Ki085712@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch main has been updated by olce: URL: https://cgit.FreeBSD.org/src/commit/?id=ab7186a486347216fde099498471cf847828565c commit ab7186a486347216fde099498471cf847828565c Author: Olivier Certner <olce@FreeBSD.org> AuthorDate: 2025-08-27 14:56:21 +0000 Commit: Olivier Certner <olce@FreeBSD.org> CommitDate: 2025-09-17 12:16:03 +0000 MAC/bsdextended: Restore matching subjects' effective GID Fixes: be1f7435ef218b1d ("kern: start tracking cr_gid outside of cr_groups[]") MFC after: 5 days MFC to: stable/15 Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D52270 --- sys/security/mac_bsdextended/mac_bsdextended.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/sys/security/mac_bsdextended/mac_bsdextended.c b/sys/security/mac_bsdextended/mac_bsdextended.c index 8a6549214380..bf95c008e2f2 100644 --- a/sys/security/mac_bsdextended/mac_bsdextended.c +++ b/sys/security/mac_bsdextended/mac_bsdextended.c @@ -246,7 +246,9 @@ ugidfw_rulecheck(struct mac_bsdextended_rule *rule, } if (rule->mbr_subject.mbs_flags & MBS_GID_DEFINED) { - match = ((cred->cr_rgid <= rule->mbr_subject.mbs_gid_max && + match = ((cred->cr_gid <= rule->mbr_subject.mbs_gid_max && + cred->cr_gid >= rule->mbr_subject.mbs_gid_min) || + (cred->cr_rgid <= rule->mbr_subject.mbs_gid_max && cred->cr_rgid >= rule->mbr_subject.mbs_gid_min) || (cred->cr_svgid <= rule->mbr_subject.mbs_gid_max && cred->cr_svgid >= rule->mbr_subject.mbs_gid_min));
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202509171219.58HCJ3Ki085712>