Author: jamie
Date: Sat Dec 27 02:17:35 2014
New Revision: 276277
URL: https://svnweb.freebsd.org/changeset/base/276277
Log:
MFC r275906:
Setgid before running a command as a specified user. Previously only
initgroups(3) was called, what isn't quite enough. This brings jail(8)
in line with jexec(8), which was already doing the right thing.
PR: 195984
Modified:
stable/10/usr.sbin/jail/command.c
Directory Properties:
stable/10/ (props changed)
Modified: stable/10/usr.sbin/jail/command.c
==============================================================================
--- stable/10/usr.sbin/jail/command.c Sat Dec 27 02:17:35 2014
(r276276)
+++ stable/10/usr.sbin/jail/command.c Sat Dec 27 02:17:35 2014
(r276277)
@@ -668,6 +668,11 @@ run_command(struct cfjail *j)
if (term != NULL)
setenv("TERM", term, 1);
}
+ if (setgid(pwd->pw_gid) < 0) {
+ jail_warnx(j, "setgid %d: %s", pwd->pw_gid,
+ strerror(errno));
+ exit(1);
+ }
if (setusercontext(lcap, pwd, pwd->pw_uid, username
? LOGIN_SETALL & ~LOGIN_SETGROUP & ~LOGIN_SETLOGIN
: LOGIN_SETPATH | LOGIN_SETENV) < 0) {
_______________________________________________
svn-src-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
