From owner-freebsd-hackers@FreeBSD.ORG  Fri Nov 27 16:52:45 2009
Return-Path: <owner-freebsd-hackers@FreeBSD.ORG>
Delivered-To: freebsd-hackers@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 3D5821065670
	for <freebsd-hackers@freebsd.org>; Fri, 27 Nov 2009 16:52:45 +0000 (UTC)
	(envelope-from ap00@mail.ru)
Received: from mx27.mail.ru (mx27.mail.ru [94.100.176.41])
	by mx1.freebsd.org (Postfix) with ESMTP id F0DA88FC14
	for <freebsd-hackers@freebsd.org>; Fri, 27 Nov 2009 16:52:44 +0000 (UTC)
Received: from [91.190.115.253] (port=49089 helo=pstation)
	by mx27.mail.ru with asmtp id 1NE43n-0000tp-00
	for freebsd-hackers@freebsd.org; Fri, 27 Nov 2009 19:52:43 +0300
Date: Fri, 27 Nov 2009 19:56:59 +0300
From: Anthony Pankov <ap00@mail.ru>
X-Mailer: The Bat! (v1.51) Personal
X-Priority: 3 (Normal)
Message-ID: <15434604890.20091127195659@mail.ru>
To: freebsd-hackers@freebsd.org
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
X-Spam: Not detected
X-Mras: Ok
Subject: ucred when euid/egid
X-BeenThere: freebsd-hackers@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
Reply-To: Anthony Pankov <ap00@mail.ru>
List-Id: Technical Discussions relating to FreeBSD
	<freebsd-hackers.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-hackers>, 
	<mailto:freebsd-hackers-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-hackers>
List-Post: <mailto:freebsd-hackers@freebsd.org>
List-Help: <mailto:freebsd-hackers-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-hackers>,
	<mailto:freebsd-hackers-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 27 Nov 2009 16:52:45 -0000

Hello,

I face some misunderstood situation related to the access permissions.


There is a program(script) with the suid/sgid (mode 6555):

r-sr-sr-x   fuser:proggroup  theprog

There is a file:
rw-rw----   someone:filegroup    thefile


User 'fuser' (==program euid) have primary group 'filegroup'(==group,
who can read/write thefile).

Program try to read(write) thefile and fail with permissions.

I don't fully understand why.

According  VOP_ACCESS(9) there is a check

  /* Otherwise, check the groups. */
 for (i = 0, gp = cred->cr_groups; i < cred->cr_ngroups; i++, gp++)
 ...

So, i have only one assumption: when seteuided program executed ucred
struct and cred->cr_groups doesn't change accordingly to euid/egid and
stay the same as for executor.

Is this a bug (how can i fix it) or feature (how can i bypass it)?


-- 
Best regards,
 Anthony                          mailto:ap00@mail.ru