HomeFreeBSD

cr_canseeothergids(): Use real instead of effective group membership

Description

cr_canseeothergids(): Use real instead of effective group membership

Using the effective group and not the real one when testing membership
has the consequence that unprivileged processes cannot see setuid
commands they launch until these have relinquished their privileges.
This is also in contradiction with how the similar cr_canseeotheruids()
works, i.e., by taking into account real user IDs.

Fix this by substituting groupmember() with realgroupmember(). While
here, simplify the code.

PR: 272093
Reviewed by: mhorne
Sponsored by: Kumacom SAS
Differential Revision: https://reviews.freebsd.org/D40642

(cherry picked from commit 91658080f1a598ddda03943a783c9a941199f7d2)

Approved by: markj (mentor)

Details

Provenance
olceAuthored on Aug 17 2023, 11:54 PM
Reviewer
mhorne
Differential Revision
D40642: cr_canseeothergids(): Use real instead of effective group membership
Parents
rG3eb8bf041831: realgroupmember(9): Link to groupmember(9), document the function
Branches
Unknown
Tags
Unknown