ssh: sshd-session: properly save off the privileged gid

Current and traditional FreeBSD behavior means that getegid() here is
the first element in the prior setgroups() call, if any, so we may
inadvertently wipe out our rgid with the unprivileged gid.  This is
rendered somewhat harmless by the fact that we're losing the privileged
gid -- we'll still regain it as the egid in restore_uid() later by way
of restoring saved_egroups, rather than by intentionally restoring it
from getgid().

This will be promptly reverted if we can get setgroups(2)/getgroups(2)
changed in FreeBSD 15.0, but it seemed wise to get this technically
correct for previous branches.

Reviewed by:	jlduran
Differential Revision:	https://reviews.freebsd.org/D51753

1 files changed, 15 insertions, 0 deletions

diff --git a/crypto/openssh/uidswap.c b/crypto/openssh/uidswap.c
index 6ed3024d0180..0143f4994611 100644
--- a/crypto/openssh/uidswap.c
+++ b/crypto/openssh/uidswap.c
@@ -14,6 +14,9 @@
 
 #include "includes.h"
 
+#ifdef __FreeBSD__
+#include <assert.h>
+#endif
 #include <errno.h>
 #include <pwd.h>
 #include <string.h>
@@ -121,8 +124,20 @@ temporarily_use_uid(struct passwd *pw)
 		fatal("setgroups: %.100s", strerror(errno));
 #ifndef SAVED_IDS_WORK_WITH_SETEUID
 	/* Propagate the privileged gid to all of our gids. */
+#ifdef __FreeBSD__
+	/*
+	 * FreeBSD traditionally includes the egid as the first element.  If we
+	 * use getegid() here then we effectively propagate user_groups[0],
+	 * which is probably pw->pw_gid.  Fix it to work as intended by using
+	 * the egid we already have stashed off.
+	 */
+	assert(saved_egroupslen > 0);
+	if (setgid(saved_egroups[0]) == -1)
+		debug("setgid %u: %.100s", (u_int) saved_egroups[0], strerror(errno));
+#else
 	if (setgid(getegid()) == -1)
 		debug("setgid %u: %.100s", (u_int) getegid(), strerror(errno));
+#endif
 	/* Propagate the privileged uid to all of our uids. */
 	if (setuid(geteuid()) == -1)
 		debug("setuid %u: %.100s", (u_int) geteuid(), strerror(errno));