Date: Mon, 28 Oct 2024 18:58:29 GMT From: Li-Wen Hsu <lwhsu@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Subject: git: 7937bfbc0ca5 - main - mac_do(4): Enhance GID rule validation to check all groups in cr_groups Message-ID: <202410281858.49SIwTuF061249@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch main has been updated by lwhsu: URL: https://cgit.FreeBSD.org/src/commit/?id=7937bfbc0ca53fe7cdd0d54414f9296e273a518e commit 7937bfbc0ca53fe7cdd0d54414f9296e273a518e Author: Li-Wen Hsu <lwhsu@FreeBSD.org> AuthorDate: 2024-10-28 18:58:12 +0000 Commit: Li-Wen Hsu <lwhsu@FreeBSD.org> CommitDate: 2024-10-28 18:58:12 +0000 mac_do(4): Enhance GID rule validation to check all groups in cr_groups Previously, the rule validation only checked the primary GID (cr_gid). This caused issues when applying GID-based rules, as users with matching secondary groups were not considered valid. This patch modifies both functions to iterate through all groups in cr_groups to ensure all group memberships are considered when validating GID-based rules. For example, a user's primary group is staff (20) and they are also in the wheel (0) group, this change allows the rule gid=0:any to enable them to run commands as any user. Reviewed by: delphij (earlier version), bapt Differential Revision: https://reviews.freebsd.org/D47304 --- sys/security/mac_do/mac_do.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sys/security/mac_do/mac_do.c b/sys/security/mac_do/mac_do.c index 507e64ea0175..1aad37f549bc 100644 --- a/sys/security/mac_do/mac_do.c +++ b/sys/security/mac_do/mac_do.c @@ -411,7 +411,7 @@ rule_is_valid(struct ucred *cred, struct rule *r) { if (r->from_type == RULE_UID && r->f_uid == cred->cr_uid) return (true); - if (r->from_type == RULE_GID && r->f_gid == cred->cr_gid) + if (r->from_type == RULE_GID && groupmember(r->f_gid, cred)) return (true); return (false); } @@ -516,7 +516,7 @@ check_setuid(struct ucred *cred, uid_t uid) } } if (r->from_type == RULE_GID) { - if (cred->cr_gid != r->f_gid) + if (!groupmember(r->f_gid, cred)) continue; if (r->to_type == RULE_ANY) { error = 0;
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202410281858.49SIwTuF061249>