HomeFreeBSD

setusercontext(): Apply personal settings only on matching effective UID

Description

setusercontext(): Apply personal settings only on matching effective UID

Commit 35305a8dc114 (r211393) added a check on whether 'uid' was equal
to getuid() before calling setlogincontext(). Doing so still allows
a setuid program to apply resource limits and priorities specified in
a user-controlled configuration file ('~/.login_conf') where
a non-setuid program could not. Plug the hole by checking instead that
the process' effective UID is the target one (which is likely what was
meant in the initial commit).

PR: 271750
Reviewed by: kib, des
MFC after: 2 weeks
Sponsored by: Kumacom SAS
Differential Revision: https://reviews.freebsd.org/D40351
Approved by: so
Security: FreeBSD-EN-24:02.libutil

(cherry picked from commit 892654fe9b5a9115815c30a423b8db47185aebbd)
(cherry picked from commit ede6fd06726c02e9d2a5c47ac8cf80d8aaec5a70)

Details

Provenance
olceAuthored on May 30 2023, 4:35 PM
gordonCommitted on Feb 14 2024, 5:35 AM
Reviewer
kib
Differential Revision
D40351: setusercontext(): Apply user login context only on process' euid being set
Parents
rG007b8b8ecd96: contrib/tzdata: import tzdata 2024a
Branches
Unknown
Tags
Unknown