Date: Fri, 29 May 2026 16:01:51 +0000 From: Olivier Certner <olce@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Subject: git: 888a84ceeded - main - MAC/do: Fix reporting of "mac.do" post-"executable paths" Message-ID: <6a19b86f.36109.119d6c7b@gitrepo.freebsd.org>
index | next in thread | raw e-mail
The branch main has been updated by olce: URL: https://cgit.FreeBSD.org/src/commit/?id=888a84ceeded9ef69903e352827cdef58163027e commit 888a84ceeded9ef69903e352827cdef58163027e Author: Olivier Certner <olce@FreeBSD.org> AuthorDate: 2026-04-28 13:17:18 +0000 Commit: Olivier Certner <olce@FreeBSD.org> CommitDate: 2026-05-29 15:28:29 +0000 MAC/do: Fix reporting of "mac.do" post-"executable paths" In mac_do_jail_get(), computation of 'jsys' had not been updated to take into account executable paths. Reviewed by: bapt Fixes: 9818224174c4 ("MAC/do: Executable paths feature (GSoC 2025's final state)") MFC after: 1 month Sponsored by: The FreeBSD Foundation Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/38 --- sys/security/mac_do/mac_do.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/sys/security/mac_do/mac_do.c b/sys/security/mac_do/mac_do.c index fb7eb00cd6d5..8ed1f18a8df6 100644 --- a/sys/security/mac_do/mac_do.c +++ b/sys/security/mac_do/mac_do.c @@ -1560,9 +1560,8 @@ mac_do_jail_get(void *obj, void *data) const struct exec_paths *const exec_paths = &applicable_conf->exec_paths; int jsys, error; - jsys = hpr == pr ? - (STAILQ_EMPTY(&rules->head) ? JAIL_SYS_DISABLE : JAIL_SYS_NEW) : - JAIL_SYS_INHERIT; + jsys = hpr == pr ? (has_rules(rules) && has_exec_paths(exec_paths) ? + JAIL_SYS_NEW : JAIL_SYS_DISABLE) : JAIL_SYS_INHERIT; error = vfs_setopt(opts, "mac.do", &jsys, sizeof(jsys)); if (error != 0 && error != ENOENT)home | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?6a19b86f.36109.119d6c7b>