In D59309#1360723, @markj wrote:

Bytes trailing the nul terminator in the device_name field are leaked.

Use of memset() should be systematic on stack-allocated structures for security reasons. The compiler normally eliminates the dead stores.

Please check inline comment, there may be a leak.

The text of the advisory is really great! Thanks.

In D59051, @markj wrote:

group_is_primary() has exactly one use, in mac_do. There, it's used to
determine whether to keep the caller's current primary groups. This
means that a rule such as gid=0>uid=0 will permit any credential with no
supplementary groups.

In D59051#1354343, @kevans wrote:

That's a bit embarrasing. =\ I have no idea how this one was overlooked, I did a lot of grepping around for cr_groups indexing...

In D57829#1329883, @ali_mashtizadeh.com wrote:

Do you have your tree for the stuff from your talk because, I'd like to compare notes. I had a few other odd behaviors I found. Some of them I didn't fix yet but couldn't tell if you did from your talk.

Yes, I've noticed it also and is addressed in one of my staged commits. I'm AFK till the end of the month, though.

Have received notifications that you made updates. I'm mostly AFK until end of August, so please expect slow responses or no response at all until that point. Thanks for your patience.

While here, you could apply the same treatment to the preceding if, except the call to parse_modmetadata() needs to be preserved. The fact that the return process is the same irrespective of whether that latter call returns 0 or not looks suspect. After a very quick glance, this function does not seem to have proper error reporting anyway.

A quite quick review, which I'll complete later, but unfortunately only after a while since I'm about to be almost completely AFK for ~4 weeks.

Please merge this into D44456.

Please see D56546's herald comment.

You should probably merge this revision with D56547. I have reviewed the merged result of this one, that one and D57939 (Koine Yuusuke's). Inline comments have been put in the relevant reviews as much as possible, but general comments are all listed below.