diff options
| author | Olivier Certner <olce@FreeBSD.org> | 2025-08-27 15:22:26 +0000 |
|---|---|---|
| committer | Olivier Certner <olce@FreeBSD.org> | 2025-09-17 12:16:03 +0000 |
| commit | d39756f23fe223d14ff00b1392ba39e94d5eadbc (patch) | |
| tree | 31a9399838347bdb34da221a0204db3da06a21da | |
| parent | ab7186a486347216fde099498471cf847828565c (diff) | |
MAC/do: Restore matching the first supplementary group
As 'cr_gid' was in fact stored in cr_groups[0],
rule_grant_supplementary_groups() would loop only on further elements of
cr_groups[]. Now that cr_groups[0] is not 'cr_gid' anymore, but some
supplementary group, take it into account.
Fixes: be1f7435ef218b1d ("kern: start tracking cr_gid outside of cr_groups[]")
MFC after: 5 days
MFC to: stable/15
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D52271
| -rw-r--r-- | sys/security/mac_do/mac_do.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sys/security/mac_do/mac_do.c b/sys/security/mac_do/mac_do.c index 7a5ac2e01f75..6f3e63d06198 100644 --- a/sys/security/mac_do/mac_do.c +++ b/sys/security/mac_do/mac_do.c @@ -1650,7 +1650,7 @@ rule_grant_supplementary_groups(const struct rule *const rule, const bool current_has_supp = (gid_flags & MDF_CURRENT) != 0 && (gid_flags & MDF_SUPP_MASK) != 0; id_nb_t rule_idx = 0; - int old_idx = 1, new_idx = 1; + int old_idx = 0, new_idx = 0; if ((gid_flags & MDF_ANY_SUPP) != 0 && (gid_flags & MDF_MAY_REJ_SUPP) == 0) |