diff options
| author | Jamie Gritton <jamie@FreeBSD.org> | 2014-12-18 18:10:39 +0000 |
|---|---|---|
| committer | Jamie Gritton <jamie@FreeBSD.org> | 2014-12-18 18:10:39 +0000 |
| commit | eb28afe4221409a70cd8a064f77fe88af86da2e2 (patch) | |
| tree | 7bdd584c064d3ab633fd91af24502decb4a9ec84 /usr.sbin/jail/command.c | |
| parent | b9a2a3f1cf7320a3fb2df655be2060c234be0e9c (diff) | |
| download | src-eb28afe4221409a70cd8a064f77fe88af86da2e2.tar.gz src-eb28afe4221409a70cd8a064f77fe88af86da2e2.zip | |
Setgid before running a command as a specified user. Previously only
initgroups(3) was called, what isn't quite enough. This brings jail(8)
in line with jexec(8), which was already doing the right thing.
PR: 195984
MFC after: 1 week
Notes
Notes:
svn path=/head/; revision=275906
Diffstat (limited to 'usr.sbin/jail/command.c')
| -rw-r--r-- | usr.sbin/jail/command.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/usr.sbin/jail/command.c b/usr.sbin/jail/command.c index 6101e078bc2c..6fefe414be67 100644 --- a/usr.sbin/jail/command.c +++ b/usr.sbin/jail/command.c @@ -667,6 +667,11 @@ run_command(struct cfjail *j) if (term != NULL) setenv("TERM", term, 1); } + if (setgid(pwd->pw_gid) < 0) { + jail_warnx(j, "setgid %d: %s", pwd->pw_gid, + strerror(errno)); + exit(1); + } if (setusercontext(lcap, pwd, pwd->pw_uid, username ? LOGIN_SETALL & ~LOGIN_SETGROUP & ~LOGIN_SETLOGIN : LOGIN_SETPATH | LOGIN_SETENV) < 0) { |