Page MenuHomeFreeBSD

setgroups.2: Add SECURITY CONSIDERATIONS, fix the groups limit, rework
ClosedPublic

Authored by olce on Aug 29 2025, 11:04 PM.
Tags
None
Referenced Files
F131973810: D52284.id162253.diff
Sun, Oct 12, 3:23 PM
F131938712: D52284.id162253.diff
Sun, Oct 12, 8:46 AM
Unknown Object (File)
Sat, Oct 11, 10:02 PM
Unknown Object (File)
Sat, Oct 11, 10:02 PM
Unknown Object (File)
Sat, Oct 11, 10:02 PM
Unknown Object (File)
Sat, Oct 11, 12:50 PM
Unknown Object (File)
Fri, Oct 3, 4:39 PM
Unknown Object (File)
Fri, Oct 3, 3:16 PM
Subscribers

Details

Summary

Add a new SECURITY CONSIDERATIONS section describing in details what the
new behavior is after commit 9da2fe96ff2e ("kern: fix setgroups(2) and
getgroups(2) to match other platforms"), what setgroups(2) does not
do anymore, and how programs using it are affected.

Fix the groups limit after commit 9da2fe96ff2e ("kern: fix setgroups(2)
and getgroups(2) to match other platforms").

Prefer a terminology referring to POSIX terms, i.e., use "effective
group list" instead of "group access list".

While here, fix some style.

Fixes: 9da2fe96ff2e ("kern: fix setgroups(2) and getgroups(2) to match other platforms")
Sponsored by: The FreeBSD Foundation

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

olce requested review of this revision.Aug 29 2025, 11:04 PM
olce edited the summary of this revision. (Show Details)
  • Impacts of the paradigm change in D52282 in SECURITY CONSIDERATIONS. Relax the wording about applications passing the additional group/effective GID as the first element in setgroups(2). Mention that this is what initgroups(3) does.
  • Add notes about clearing all supplementary groups in HISTORY and SECURITY CONSIDERATIONS.
  • Use "calling process" instead of "current process".
  • Be explicit on gidset not being used at all when ngroups is 0 (replacing the old ambiguous formulation).
  • "GID" => "group ID", consistently with other manual pages.
This revision was not accepted when it landed; it landed in state Needs Review.Wed, Sep 17, 12:21 PM
This revision was automatically updated to reflect the committed changes.
lib/libsys/setgroups.2
1

I don't think we need this (.\"-) marker anymore