diff options
| author | Olivier Certner <olce@FreeBSD.org> | 2026-04-28 13:17:18 +0000 |
|---|---|---|
| committer | Olivier Certner <olce@FreeBSD.org> | 2026-05-29 15:28:29 +0000 |
| commit | 888a84ceeded9ef69903e352827cdef58163027e (patch) | |
| tree | 3b8cc1496ca1a53ea9a72886f71cad8a42c727dc | |
| parent | 51cc5840b66c9565e1740c1198a0e684d81e3734 (diff) | |
MAC/do: Fix reporting of "mac.do" post-"executable paths"
In mac_do_jail_get(), computation of 'jsys' had not been updated to take
into account executable paths.
Reviewed by: bapt
Fixes: 9818224174c4 ("MAC/do: Executable paths feature (GSoC 2025's final state)")
MFC after: 1 month
Sponsored by: The FreeBSD Foundation
Pull Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/38
| -rw-r--r-- | sys/security/mac_do/mac_do.c | 5 |
1 files changed, 2 insertions, 3 deletions
diff --git a/sys/security/mac_do/mac_do.c b/sys/security/mac_do/mac_do.c index fb7eb00cd6d5..8ed1f18a8df6 100644 --- a/sys/security/mac_do/mac_do.c +++ b/sys/security/mac_do/mac_do.c @@ -1560,9 +1560,8 @@ mac_do_jail_get(void *obj, void *data) const struct exec_paths *const exec_paths = &applicable_conf->exec_paths; int jsys, error; - jsys = hpr == pr ? - (STAILQ_EMPTY(&rules->head) ? JAIL_SYS_DISABLE : JAIL_SYS_NEW) : - JAIL_SYS_INHERIT; + jsys = hpr == pr ? (has_rules(rules) && has_exec_paths(exec_paths) ? + JAIL_SYS_NEW : JAIL_SYS_DISABLE) : JAIL_SYS_INHERIT; error = vfs_setopt(opts, "mac.do", &jsys, sizeof(jsys)); if (error != 0 && error != ENOENT) |