The branch stable/14 has been updated by olce: URL: https://cgit.FreeBSD.org/src/commit/?id=cc16a07a8e8fc4921e5072bff6263315918cf7bf
commit cc16a07a8e8fc4921e5072bff6263315918cf7bf Author: Olivier Certner <[email protected]> AuthorDate: 2025-10-29 16:46:39 +0000 Commit: Olivier Certner <[email protected]> CommitDate: 2025-12-19 09:16:47 +0000 kern: Fix credentials leaks on RACCT but no RCTL Affected system calls: setuid(), setreuid(), setresuid(), jail_attach(), setloginclass(). In these system calls, the crhold() calls that, on RACCT, make the just-installed process credentials survive a concurrent change of the same credentials just after PROC_UNLOCK() were not matched by a corresponding crfree() when RCTL is off. In fact, in that latter case, they are simply not necessary, so wrap them with '#ifdef RCTL' stances. 'kern_rctl.c' causes a compile error if RACCT is not defined but RCTL is, so ease reading by not nesting '#ifdef's. MFC after: 3 days Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D53456 (cherry picked from commit f4315ff8b3fee71eb0098864a84618f2f8ba85d5) --- sys/kern/kern_jail.c | 2 ++ sys/kern/kern_loginclass.c | 2 ++ sys/kern/kern_prot.c | 6 ++++++ 3 files changed, 10 insertions(+) diff --git a/sys/kern/kern_jail.c b/sys/kern/kern_jail.c index c449aba9b56a..801424794eac 100644 --- a/sys/kern/kern_jail.c +++ b/sys/kern/kern_jail.c @@ -2705,6 +2705,8 @@ do_jail_attach(struct thread *td, struct prison *pr, int drflags) setsugid(p); #ifdef RACCT racct_proc_ucred_changed(p, oldcred, newcred); +#endif +#ifdef RCTL crhold(newcred); #endif PROC_UNLOCK(p); diff --git a/sys/kern/kern_loginclass.c b/sys/kern/kern_loginclass.c index ceba563413df..f6070cae24d5 100644 --- a/sys/kern/kern_loginclass.c +++ b/sys/kern/kern_loginclass.c @@ -226,6 +226,8 @@ sys_setloginclass(struct thread *td, struct setloginclass_args *uap) proc_set_cred(p, newcred); #ifdef RACCT racct_proc_ucred_changed(p, oldcred, newcred); +#endif +#ifdef RCTL crhold(newcred); #endif PROC_UNLOCK(p); diff --git a/sys/kern/kern_prot.c b/sys/kern/kern_prot.c index c3908c8e99c9..db7377ed9c9c 100644 --- a/sys/kern/kern_prot.c +++ b/sys/kern/kern_prot.c @@ -964,6 +964,8 @@ sys_setuid(struct thread *td, struct setuid_args *uap) proc_set_cred(p, newcred); #ifdef RACCT racct_proc_ucred_changed(p, oldcred, newcred); +#endif +#ifdef RCTL crhold(newcred); #endif PROC_UNLOCK(p); @@ -1342,6 +1344,8 @@ sys_setreuid(struct thread *td, struct setreuid_args *uap) proc_set_cred(p, newcred); #ifdef RACCT racct_proc_ucred_changed(p, oldcred, newcred); +#endif +#ifdef RCTL crhold(newcred); #endif PROC_UNLOCK(p); @@ -1488,6 +1492,8 @@ sys_setresuid(struct thread *td, struct setresuid_args *uap) proc_set_cred(p, newcred); #ifdef RACCT racct_proc_ucred_changed(p, oldcred, newcred); +#endif +#ifdef RCTL crhold(newcred); #endif PROC_UNLOCK(p);
