Date: Thu, 27 Jun 2024 08:48:36 GMT From: Baptiste Daroussin <bapt@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Subject: git: 9722023c4875 - stable/14 - MAC/do: allow to call setuid if real user id is 0 Message-ID: <202406270848.45R8maqD093182@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch stable/14 has been updated by bapt: URL: https://cgit.FreeBSD.org/src/commit/?id=9722023c4875a326ee9e4e9e0db71d463d990368 commit 9722023c4875a326ee9e4e9e0db71d463d990368 Author: Baptiste Daroussin <bapt@FreeBSD.org> AuthorDate: 2024-05-23 10:09:11 +0000 Commit: Baptiste Daroussin <bapt@FreeBSD.org> CommitDate: 2024-06-27 08:47:06 +0000 MAC/do: allow to call setuid if real user id is 0 This fixed sshd not able to call restore_uid when MAC/do policy is loaded (cherry picked from commit 61b07f8aa52844b21637ac264ea134c1aef48cb7) --- sys/security/mac_do/mac_do.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/security/mac_do/mac_do.c b/sys/security/mac_do/mac_do.c index 8685954b7db6..507e64ea0175 100644 --- a/sys/security/mac_do/mac_do.c +++ b/sys/security/mac_do/mac_do.c @@ -489,7 +489,7 @@ check_setuid(struct ucred *cred, uid_t uid) if (do_enabled == 0) return (0); - if (cred->cr_uid == uid || cred->cr_uid == 0) + if (cred->cr_uid == uid || cred->cr_uid == 0 || cred->cr_ruid == 0) return (0); if (vn_fullpath(curproc->p_textvp, &fullpath, &freebuf) != 0)
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202406270848.45R8maqD093182>