d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Setgid before running a command as a specified user. Previously only

Browse Source 
initgroups(3) was called, what isn't quite enough.  This brings jail(8)
in line with jexec(8), which was already doing the right thing.

PR:		195984
MFC after:	1 week
This commit is contained in:
Jamie Gritton 2014-12-18 18:10:39 +00:00
parent b9a2a3f1cf
commit eb28afe422
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
usr.sbin/jail/command.c
View File

@ -667,6 +667,11 @@ run_command(struct cfjail *j)
if (term != NULL)
setenv("TERM", term, 1);
}
if (setgid(pwd->pw_gid) < 0) {
jail_warnx(j, "setgid %d: %s", pwd->pw_gid,
strerror(errno));
exit(1);
}
if (setusercontext(lcap, pwd, pwd->pw_uid, username
? LOGIN_SETALL & ~LOGIN_SETGROUP & ~LOGIN_SETLOGIN
: LOGIN_SETPATH | LOGIN_SETENV) < 0) {