jimzah/freebsd-src
1
0
Fork 0
mirror of https://github.com/freebsd/freebsd-src.git synced 2024-12-03 08:22:44 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

o As part of the move to not maintaining copies of the vnode owning uid

Browse Source 
and gid in the ACL, vaccess_acl_posix1e() was changed to accept
  explicit file_uid and file_gid as arguments.  However, in making the
  change, I explicitly checked file_gid against cr->cr_groups[0], rather
  than using groupmember, resulting in ACL_GROUP_OBJ entries being
  compared to the caller's effective gid only, not the remainder of
  its groups.  This was recently corrected for the version of the
  group call without privilege, but the second test (when privilege is
  added) was missed.  This change replaces an additiona cr->cr_groups[0]
  check with groupmember().

Pointed out by:	jedgar
Reviewed by:	jedgar
Obtained from:	TrustedBSD Project
This commit is contained in:
Robert Watson 2001-04-29 19:53:50 +00:00
parent b31c959ff3
commit 46157a65d7
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=76139
3 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
sys/kern/kern_acl.c
View File

@ -276,7 +276,7 @@ vaccess_acl_posix1e(enum vtype type, uid_t file_uid, gid_t file_gid,
for (i = 0; i < acl->acl_cnt; i++) {
switch (acl->acl_entry[i].ae_tag) {
case ACL_GROUP_OBJ:
if (file_gid != cred->cr_groups[0])
if (!groupmember(file_gid, cred))
break;
dac_granted = 0;
if (acl->acl_entry[i].ae_perm & ACL_EXECUTE)

2
sys/kern/subr_acl_posix1e.c
View File

@ -276,7 +276,7 @@ vaccess_acl_posix1e(enum vtype type, uid_t file_uid, gid_t file_gid,
for (i = 0; i < acl->acl_cnt; i++) {
switch (acl->acl_entry[i].ae_tag) {
case ACL_GROUP_OBJ:
if (file_gid != cred->cr_groups[0])
if (!groupmember(file_gid, cred))
break;
dac_granted = 0;
if (acl->acl_entry[i].ae_perm & ACL_EXECUTE)

2
sys/kern/vfs_acl.c
View File

@ -276,7 +276,7 @@ vaccess_acl_posix1e(enum vtype type, uid_t file_uid, gid_t file_gid,
for (i = 0; i < acl->acl_cnt; i++) {
switch (acl->acl_entry[i].ae_tag) {
case ACL_GROUP_OBJ:
if (file_gid != cred->cr_groups[0])
if (!groupmember(file_gid, cred))
break;
dac_granted = 0;
if (acl->acl_entry[i].ae_perm & ACL_EXECUTE)