From e47bda07309818f3ac8f2b00fdc03575d5f6ce00 Mon Sep 17 00:00:00 2001 From: David Greenman Date: Wed, 19 Feb 1997 03:51:34 +0000 Subject: [PATCH] Fix from PR #2757: execve() clears the P_SUGID process flag in execve() if the binary executed does not have suid or sgid permission bits set. This also happens when the effective uid is different from the real uid or the effective gid is different from the real gid. Under these circumstances, the process still has set id privileges and the P_SUGID flag should not be cleared. Submitted by: Tor Egge --- sys/kern/kern_exec.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/sys/kern/kern_exec.c b/sys/kern/kern_exec.c index 2d4247ca29a4..e3b1da951d27 100644 --- a/sys/kern/kern_exec.c +++ b/sys/kern/kern_exec.c @@ -285,7 +285,9 @@ interpret: p->p_ucred->cr_groups[0] = attr.va_gid; p->p_flag |= P_SUGID; } else { - p->p_flag &= ~P_SUGID; + if (p->p_ucred->cr_uid == p->p_cred->p_ruid && + p->p_ucred->cr_gid == p->p_cred->p_rgid) + p->p_flag &= ~P_SUGID; } /*