cred: Fix group_is_primary()

This helper wasn't updated in commit be1f7435ef21, so in reality it was
testing whether "gid" is the first supplemental group.  If a user
doesn't belong to a supplementary group, then it's testing an
uninitialized slot; since ucreds are allocated with M_ZERO, this
typically means that we're testing gid == 0.

group_is_primary() has exactly one use, in mac_do.  There, it's used to
determine whether the requested primary GID can be used in a setcred(2)
call when the ruleset does not explicitly specify a target primary GID.

I believe this is mostly exploitable by daemons which have explicitly
dropped privileges and called setgroups(0, NULL); logged in users will
have a non-empty supplementary group list by virtue of having gone
through initgroups(3).

Fix group_is_primary(), and add a regression test.

Approved by:	so
Security:	FreeBSD-SA-26:59.mac_do
Security:	CVE-2026-58092
Reported by:	Hazley Samsudin of GovTech CSG
Fixes:		be1f7435ef21 ("kern: start tracking cr_gid outside of cr_groups[]")
Reviewed by:	olce, kevans
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D59051

0 files changed, 0 insertions, 0 deletions