Author: jamie Date: Thu Dec 18 18:10:39 2014 New Revision: 275906 URL: https://svnweb.freebsd.org/changeset/base/275906
Log: Setgid before running a command as a specified user. Previously only initgroups(3) was called, what isn't quite enough. This brings jail(8) in line with jexec(8), which was already doing the right thing. PR: 195984 MFC after: 1 week Modified: head/usr.sbin/jail/command.c Modified: head/usr.sbin/jail/command.c ============================================================================== --- head/usr.sbin/jail/command.c Thu Dec 18 16:57:22 2014 (r275905) +++ head/usr.sbin/jail/command.c Thu Dec 18 18:10:39 2014 (r275906) @@ -667,6 +667,11 @@ run_command(struct cfjail *j) if (term != NULL) setenv("TERM", term, 1); } + if (setgid(pwd->pw_gid) < 0) { + jail_warnx(j, "setgid %d: %s", pwd->pw_gid, + strerror(errno)); + exit(1); + } if (setusercontext(lcap, pwd, pwd->pw_uid, username ? LOGIN_SETALL & ~LOGIN_SETGROUP & ~LOGIN_SETLOGIN : LOGIN_SETPATH | LOGIN_SETENV) < 0) { _______________________________________________ svn-src-head@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/svn-src-head To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"