From owner-freebsd-arch@FreeBSD.ORG Thu Jun 7 19:32:50 2007 Return-Path: X-Original-To: freebsd-arch@FreeBSD.org Delivered-To: freebsd-arch@FreeBSD.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 2E90E16A46C for ; Thu, 7 Jun 2007 19:32:50 +0000 (UTC) (envelope-from stas@FreeBSD.org) Received: from com1.ht-systems.ru (com1.ht-systems.ru [83.97.104.204]) by mx1.freebsd.org (Postfix) with ESMTP id DD21013C447 for ; Thu, 7 Jun 2007 19:32:49 +0000 (UTC) (envelope-from stas@FreeBSD.org) Received: from [85.21.245.235] (helo=phonon.SpringDaemons.com) by com1.ht-systems.ru with esmtpa (Exim 4.62) (envelope-from ) id 1HwLwW-000325-04; Thu, 07 Jun 2007 21:38:40 +0400 Received: from localhost (localhost [127.0.0.1]) by phonon.SpringDaemons.com (Postfix) with SMTP id DC22F1145D; Thu, 7 Jun 2007 21:36:55 +0400 (MSD) Date: Thu, 7 Jun 2007 21:36:50 +0400 From: Stanislav Sedov To: freebsd-arch@FreeBSD.org Message-Id: <20070607213650.c02130bf.stas@FreeBSD.org> Organization: The FreeBSD Project X-Mailer: carrier-pigeon X-Voice: +7 916 849 20 23 X-XMPP: ssedov@jabber.ru X-ICQ: 208105021 X-Yahoo: stanislav_sedov X-PGP-Fingerprint: F21E D6CC 5626 9609 6CE2 A385 2BF5 5993 EB26 9581 X-University: MEPhI Mime-Version: 1.0 Content-Type: multipart/signed; protocol="application/pgp-signature"; micalg="PGP-SHA1"; boundary="Signature=_Thu__7_Jun_2007_21_36_50_+0400_q=oaWEyO7sI7gu3K" X-Spam-Flag: SKIP X-Spam-Yversion: Spamooborona 1.6.0 Cc: freebsd-hackers@FreeBSD.org, timur@gnu.org Subject: setegid bug X-BeenThere: freebsd-arch@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussion related to FreeBSD architecture List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 07 Jun 2007 19:32:50 -0000 --Signature=_Thu__7_Jun_2007_21_36_50_+0400_q=oaWEyO7sI7gu3K Content-Type: text/plain; charset=US-ASCII Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Hi! Recently several FreeBSD samba users reported a scary problem with samba (http://bugzilla.samba.org/?id=3D3990). Further research in cooperation with Timur Bakeyev (timur) showed, that we have a little problem with setegid implementation. In FreeBSD (and even in 4.4BSD-Lite2) egid of the process is merely groups[0], so calling seteuid function we simply override the first of supplementary groups. However, POSIX says that not rgid, not any of supplementary groups should bot be rewritten in setegid call. There's some comments about optimizations which caused so scary implementation, but I can't get what these optimizations are. Our first cvs revision of kern_prot.c already contains similar implementation with egid being effectively groups[0]. Probably, some of old-school committers remembered the initial intention of making egid equal to groups[0]? Probably, I have missed something? Thanks a lot! --=20 Stanislav Sedov ST4096-RIPE --Signature=_Thu__7_Jun_2007_21_36_50_+0400_q=oaWEyO7sI7gu3K Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.3 (FreeBSD) iD8DBQFGaEI3K/VZk+smlYERAkwdAJ9Sp8lDY3Pq9ip1bx9M67GR+w+cPgCeI6EK S1nHdh1Q416bECsdbapzk70= =skA0 -----END PGP SIGNATURE----- --Signature=_Thu__7_Jun_2007_21_36_50_+0400_q=oaWEyO7sI7gu3K--