Differential D52268

cred: Restore proper checking of effective groups in some security policies
ClosedPublic
Actions

Authored by olce on Aug 29 2025, 11:03 PM.

Tags

None

Referenced Files

	F156632499: D52268.id161234.diff
	Fri, May 15, 6:29 AM

	Unknown Object (File)
	Tue, May 12, 12:48 PM

	Unknown Object (File)
	Tue, May 12, 10:10 AM

	Unknown Object (File)
	Wed, May 6, 9:40 AM

	Unknown Object (File)
	Wed, Apr 29, 11:59 AM

	Unknown Object (File)
	Sat, Apr 25, 2:42 AM

	Unknown Object (File)
	Thu, Apr 16, 9:21 AM

	Unknown Object (File)
	Apr 7 2026, 4:10 AM

View All 56 Files

Subscribers

Details

Reviewers

kevans
emaste

Commits

rG0d836d126129: cred: Restore proper checking of effective groups in some security policies
rGfa1cbb02d120: cred: Restore proper checking of effective groups in some security policies

Summary

The removal of 'cr_gid' from cr_groups[] as cr_groups[0] made
cr_canseeothergids() skip considering the subject's first supplementary
group, causing the 'security.bsd.see_other_gids' policy to be too
restrictive, and cr_xids_subset() miss a check on the effective GID,
relaxing the "can debug" and "can export KTLS keys" checks.

Fix these policies.

Fixes: be1f7435ef218b1d ("kern: start tracking cr_gid outside of cr_groups[]")
Sponsored by: The FreeBSD Foundation

Diff Detail

Repository

rG FreeBSD src repository

Lint

Lint Not Applicable

Unit

Tests Not Applicable

Event Timeline

olce created this revision.Aug 29 2025, 11:03 PM

Herald added a subscriber: imp. · View Herald TranscriptAug 29 2025, 11:03 PM

olce requested review of this revision.Aug 29 2025, 11:03 PM

Harbormaster completed remote builds in B66671: Diff 161234.Aug 29 2025, 11:03 PM

olce added a child revision: D52272: cr_canseeothergids(): Make the logic easier to grasp.Sep 1 2025, 3:43 PM

olce added a reviewer: emaste.Sep 1 2025, 4:23 PM

This revision was not accepted when it landed; it landed in state Needs Review.Sep 17 2025, 12:21 PM

Closed by commit rGfa1cbb02d120: cred: Restore proper checking of effective groups in some security policies (authored by olce). · Explain Why

This revision was automatically updated to reflect the committed changes.

olce added a commit: rGfa1cbb02d120: cred: Restore proper checking of effective groups in some security policies.

olce added a commit: rG0d836d126129: cred: Restore proper checking of effective groups in some security policies.Sep 23 2025, 12:04 PM

Revision Contents
Changeset List

Path

Size

sys/

kern/

3 lines

Diff 162237

sys/kern/kern_prot.c

Loading...