diff options
| author | Baptiste Daroussin <bapt@FreeBSD.org> | 2024-05-23 10:09:11 +0000 |
|---|---|---|
| committer | Baptiste Daroussin <bapt@FreeBSD.org> | 2024-05-23 10:09:11 +0000 |
| commit | 61b07f8aa52844b21637ac264ea134c1aef48cb7 (patch) | |
| tree | de0f3d04bf1c738752c7bfe8038d8edbed66a1e3 | |
| parent | 56a8aca83ab5a93af05f4c8c3a358b71a8392af8 (diff) | |
MAC/do: allow to call setuid if real user id is 0
This fixed sshd not able to call restore_uid when MAC/do policy is
loaded
| -rw-r--r-- | sys/security/mac_do/mac_do.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sys/security/mac_do/mac_do.c b/sys/security/mac_do/mac_do.c index 8685954b7db6..507e64ea0175 100644 --- a/sys/security/mac_do/mac_do.c +++ b/sys/security/mac_do/mac_do.c @@ -489,7 +489,7 @@ check_setuid(struct ucred *cred, uid_t uid) if (do_enabled == 0) return (0); - if (cred->cr_uid == uid || cred->cr_uid == 0) + if (cred->cr_uid == uid || cred->cr_uid == 0 || cred->cr_ruid == 0) return (0); if (vn_fullpath(curproc->p_textvp, &fullpath, &freebuf) != 0) |