Differential D52268

cred: Restore proper checking of effective groups in some security policies
ClosedPublic
Actions

Authored by olce on Aug 29 2025, 11:03 PM.

Tags

None

Referenced Files

	Unknown Object (File)
	Sat, Oct 11, 5:08 AM

	Unknown Object (File)
	Fri, Oct 10, 12:22 PM

	Unknown Object (File)
	Fri, Oct 10, 12:22 PM

	Unknown Object (File)
	Fri, Oct 10, 12:22 PM

	Unknown Object (File)
	Fri, Oct 10, 12:22 PM

	Unknown Object (File)
	Fri, Oct 10, 5:35 AM

	Unknown Object (File)
	Tue, Sep 23, 9:04 PM

	Unknown Object (File)
	Mon, Sep 22, 8:06 PM

View All 23 Files

Subscribers

Details

Reviewers

kevans
emaste

Commits

rG0d836d126129: cred: Restore proper checking of effective groups in some security policies
rGfa1cbb02d120: cred: Restore proper checking of effective groups in some security policies

Summary

The removal of 'cr_gid' from cr_groups[] as cr_groups[0] made
cr_canseeothergids() skip considering the subject's first supplementary
group, causing the 'security.bsd.see_other_gids' policy to be too
restrictive, and cr_xids_subset() miss a check on the effective GID,
relaxing the "can debug" and "can export KTLS keys" checks.

Fix these policies.

Fixes: be1f7435ef218b1d ("kern: start tracking cr_gid outside of cr_groups[]")
Sponsored by: The FreeBSD Foundation

Diff Detail

Repository

rG FreeBSD src repository

Lint

Lint Not Applicable

Unit

Tests Not Applicable

Event Timeline

olce created this revision.Aug 29 2025, 11:03 PM

Herald added a subscriber: imp. · View Herald TranscriptAug 29 2025, 11:03 PM

olce requested review of this revision.Aug 29 2025, 11:03 PM

Harbormaster completed remote builds in B66671: Diff 161234.Aug 29 2025, 11:03 PM

olce added a child revision: D52272: cr_canseeothergids(): Make the logic easier to grasp.Sep 1 2025, 3:43 PM

olce added a reviewer: emaste.Sep 1 2025, 4:23 PM

This revision was not accepted when it landed; it landed in state Needs Review.Wed, Sep 17, 12:21 PM

Closed by commit rGfa1cbb02d120: cred: Restore proper checking of effective groups in some security policies (authored by olce). · Explain Why

This revision was automatically updated to reflect the committed changes.

olce added a commit: rGfa1cbb02d120: cred: Restore proper checking of effective groups in some security policies.

olce added a commit: rG0d836d126129: cred: Restore proper checking of effective groups in some security policies.Tue, Sep 23, 12:04 PM

Revision Contents
Changeset List

Path

Size

sys/

kern/

3 lines

Diff 162237

sys/kern/kern_prot.c

Loading...