Page MenuHomeFreeBSD
Differential D52268

cred: Restore proper checking of effective groups in some security policies
ClosedPublic
Actions

Authored by olce on Aug 29 2025, 11:03 PM.
Tags
None
Referenced Files
F172554717: D52268.id.diff
Sat, Sep 19, 5:49 AM
Unknown Object (File)
Thu, Sep 17, 10:09 PM
Unknown Object (File)
Thu, Sep 17, 4:54 PM
Unknown Object (File)
Thu, Sep 17, 11:00 AM
Unknown Object (File)
Wed, Sep 16, 10:26 PM
Unknown Object (File)
Sat, Sep 12, 1:45 PM
Unknown Object (File)
Sat, Sep 12, 1:43 PM
Unknown Object (File)
Sat, Sep 12, 1:39 PM
View All 98 Files
Subscribers
emaste
imp

Details

Reviewers
kevans
emaste
Commits
rG0d836d126129: cred: Restore proper checking of effective groups in some security policies
rGfa1cbb02d120: cred: Restore proper checking of effective groups in some security policies
Summary

The removal of 'cr_gid' from cr_groups[] as cr_groups[0] made
cr_canseeothergids() skip considering the subject's first supplementary
group, causing the 'security.bsd.see_other_gids' policy to be too
restrictive, and cr_xids_subset() miss a check on the effective GID,
relaxing the "can debug" and "can export KTLS keys" checks.

Fix these policies.

Fixes: be1f7435ef218b1d ("kern: start tracking cr_gid outside of cr_groups[]")
Sponsored by: The FreeBSD Foundation

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Revision Contents
Changeset List

PathSize
sys/
kern/
3 lines

Diff 162237

View Options

sys/kern/kern_prot.c

Loading...