Differential D52268

cred: Restore proper checking of effective groups in some security policies
ClosedPublic
Actions

Authored by olce on Aug 29 2025, 11:03 PM.

Tags

None

Referenced Files

	Unknown Object (File)
	Wed, May 20, 5:28 AM

	Unknown Object (File)
	Wed, May 20, 1:28 AM

	Unknown Object (File)
	Tue, May 19, 11:44 AM

	Unknown Object (File)
	Sat, May 16, 6:26 AM

	Unknown Object (File)
	Sat, May 16, 1:13 AM

	Unknown Object (File)
	Sat, May 16, 1:13 AM

	Unknown Object (File)
	Sat, May 16, 1:13 AM

	Unknown Object (File)
	Fri, May 15, 6:29 AM

View All 63 Files

Subscribers

Details

Reviewers

kevans
emaste

Commits

rG0d836d126129: cred: Restore proper checking of effective groups in some security policies
rGfa1cbb02d120: cred: Restore proper checking of effective groups in some security policies

Summary

The removal of 'cr_gid' from cr_groups[] as cr_groups[0] made
cr_canseeothergids() skip considering the subject's first supplementary
group, causing the 'security.bsd.see_other_gids' policy to be too
restrictive, and cr_xids_subset() miss a check on the effective GID,
relaxing the "can debug" and "can export KTLS keys" checks.

Fix these policies.

Fixes: be1f7435ef218b1d ("kern: start tracking cr_gid outside of cr_groups[]")
Sponsored by: The FreeBSD Foundation

Diff Detail

Repository

rG FreeBSD src repository

Lint

Lint Skipped

Unit

Tests Skipped

Build Status

Buildable 66671
Build 63554: arc lint + arc unit

Event Timeline

olce created this revision.Aug 29 2025, 11:03 PM

Herald added a subscriber: imp. · View Herald TranscriptAug 29 2025, 11:03 PM

olce requested review of this revision.Aug 29 2025, 11:03 PM

Harbormaster completed remote builds in B66671: Diff 161234.Aug 29 2025, 11:03 PM

olce added a child revision: D52272: cr_canseeothergids(): Make the logic easier to grasp.Sep 1 2025, 3:43 PM

olce added a reviewer: emaste.Sep 1 2025, 4:23 PM

This revision was not accepted when it landed; it landed in state Needs Review.Sep 17 2025, 12:21 PM

Closed by commit rGfa1cbb02d120: cred: Restore proper checking of effective groups in some security policies (authored by olce). · Explain Why

This revision was automatically updated to reflect the committed changes.

olce added a commit: rGfa1cbb02d120: cred: Restore proper checking of effective groups in some security policies.

olce added a commit: rG0d836d126129: cred: Restore proper checking of effective groups in some security policies.Sep 23 2025, 12:04 PM

Revision Contents
Changeset List

Path

Size

sys/

kern/

3 lines

Diff 161234

sys/kern/kern_prot.c

Loading...