mac_seeotheruids: allow specificgid to be a list of groups

[kevans]

Summary

The specificgid functionality has historically allowed only a single
group to be exempt, but in practice one might want a few services to
be exempt for reasons. From a security perspective, we probably don't
want to encourage unrelated users to be grouped together solely for
this purpose, as that creates one point of shared access that could be
used for nefarious purposes.

Normalize the group list as we do cr_groups to allow for linear matching
rather than quadratic, we just need to account for the differences in
FreeBSD 15.0+ where cr_groups is entirely supplementary groups vs.
earlier versions, where cr_groups[0] is the egid and the rest is
sorted.

[csjp]

sys/security/mac_seeotheruids/mac_seeotheruids.c

158

sizeof(*newgids)

Instead? What you have works but it's wasteful. sizeof(newgids) is the size of a pointer (8 bytes on 64-bit), not the size of a gid_t (4 bytes)

176

Same here

sizeof(*newgids)

257

If suppgroups is sorted ascending do you want:

/* advance past values smaller than cgid */
while (s < nsupp && suppgroups[s] < cgid)
    s++;

here instead?

The while condition cgid < suppgroups[s] was meant to skip past entries in suppgroups that can't match. But it skips entries where suppgroups[s] is larger than cgid. For an ascending array that means it skips nothing useful... it would only fire if cgid were smaller than the current entry, at which point advancing s forward makes things worse, not better.

[kevans]

Fix sizes and wrong condition

[kevans]

sys/security/mac_seeotheruids/mac_seeotheruids.c

158

Yeah, unclear why I typo'd the allocations and not the SYSCTL_*() calls...

257

:facepalm: