Date: Sat, 27 Dec 2014 02:17:36 +0000 (UTC) From: Jamie Gritton <jamie@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-10@freebsd.org Subject: svn commit: r276277 - stable/10/usr.sbin/jail Message-ID: <201412270217.sBR2HaZG074320@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: jamie Date: Sat Dec 27 02:17:35 2014 New Revision: 276277 URL: https://svnweb.freebsd.org/changeset/base/276277 Log: MFC r275906: Setgid before running a command as a specified user. Previously only initgroups(3) was called, what isn't quite enough. This brings jail(8) in line with jexec(8), which was already doing the right thing. PR: 195984 Modified: stable/10/usr.sbin/jail/command.c Directory Properties: stable/10/ (props changed) Modified: stable/10/usr.sbin/jail/command.c ============================================================================== --- stable/10/usr.sbin/jail/command.c Sat Dec 27 02:17:35 2014 (r276276) +++ stable/10/usr.sbin/jail/command.c Sat Dec 27 02:17:35 2014 (r276277) @@ -668,6 +668,11 @@ run_command(struct cfjail *j) if (term != NULL) setenv("TERM", term, 1); } + if (setgid(pwd->pw_gid) < 0) { + jail_warnx(j, "setgid %d: %s", pwd->pw_gid, + strerror(errno)); + exit(1); + } if (setusercontext(lcap, pwd, pwd->pw_uid, username ? LOGIN_SETALL & ~LOGIN_SETGROUP & ~LOGIN_SETLOGIN : LOGIN_SETPATH | LOGIN_SETENV) < 0) {
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201412270217.sBR2HaZG074320>