diff options
| author | Olivier Certner <olce@FreeBSD.org> | 2025-08-27 14:56:21 +0000 |
|---|---|---|
| committer | Olivier Certner <olce@FreeBSD.org> | 2025-09-17 12:16:03 +0000 |
| commit | ab7186a486347216fde099498471cf847828565c (patch) | |
| tree | 16d4cbc581a747b1fce180440829248247f430ec | |
| parent | 0abeb8d8d8df1842b0c2d2276c958b0150579a1c (diff) | |
MAC/bsdextended: Restore matching subjects' effective GID
Fixes: be1f7435ef218b1d ("kern: start tracking cr_gid outside of cr_groups[]")
MFC after: 5 days
MFC to: stable/15
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D52270
| -rw-r--r-- | sys/security/mac_bsdextended/mac_bsdextended.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/sys/security/mac_bsdextended/mac_bsdextended.c b/sys/security/mac_bsdextended/mac_bsdextended.c index 8a6549214380..bf95c008e2f2 100644 --- a/sys/security/mac_bsdextended/mac_bsdextended.c +++ b/sys/security/mac_bsdextended/mac_bsdextended.c @@ -246,7 +246,9 @@ ugidfw_rulecheck(struct mac_bsdextended_rule *rule, } if (rule->mbr_subject.mbs_flags & MBS_GID_DEFINED) { - match = ((cred->cr_rgid <= rule->mbr_subject.mbs_gid_max && + match = ((cred->cr_gid <= rule->mbr_subject.mbs_gid_max && + cred->cr_gid >= rule->mbr_subject.mbs_gid_min) || + (cred->cr_rgid <= rule->mbr_subject.mbs_gid_max && cred->cr_rgid >= rule->mbr_subject.mbs_gid_min) || (cred->cr_svgid <= rule->mbr_subject.mbs_gid_max && cred->cr_svgid >= rule->mbr_subject.mbs_gid_min)); |