diff options
| author | mckusick <mckusick@FreeBSD.org> | 2018-02-06 19:09:03 +0000 |
|---|---|---|
| committer | mckusick <mckusick@FreeBSD.org> | 2018-02-06 19:09:03 +0000 |
| commit | 497d98bb301543ca5c509d4e52024e1de7f4249b (patch) | |
| tree | aea37d83af7a6fc2e751e849ed70c51abf51695e | |
| parent | d183d46c824cfbff63bde5f92a9ec59120338de5 (diff) | |
| download | FreeBSD-src-497d98bb301543ca5c509d4e52024e1de7f4249b.zip FreeBSD-src-497d98bb301543ca5c509d4e52024e1de7f4249b.tar.gz | |
MFC of 328304 and 328382.
Do not dedup egid (group entry 0)
| -rw-r--r-- | lib/libc/gen/getgrent.c | 2 | ||||
| -rw-r--r-- | lib/libc/sys/setgroups.2 | 19 |
2 files changed, 19 insertions, 2 deletions
diff --git a/lib/libc/gen/getgrent.c b/lib/libc/gen/getgrent.c index 2179fb2..0a2f044 100644 --- a/lib/libc/gen/getgrent.c +++ b/lib/libc/gen/getgrent.c @@ -434,7 +434,7 @@ gr_addgid(gid_t gid, gid_t *groups, int maxgrp, int *grpcnt) { int ret, dupc; - for (dupc = 0; dupc < MIN(maxgrp, *grpcnt); dupc++) { + for (dupc = 1; dupc < MIN(maxgrp, *grpcnt); dupc++) { if (groups[dupc] == gid) return 1; } diff --git a/lib/libc/sys/setgroups.2 b/lib/libc/sys/setgroups.2 index ef4c34c..2b20e7f 100644 --- a/lib/libc/sys/setgroups.2 +++ b/lib/libc/sys/setgroups.2 @@ -28,7 +28,7 @@ .\" @(#)setgroups.2 8.2 (Berkeley) 4/16/94 .\" $FreeBSD$ .\" -.Dd April 16, 1994 +.Dd January 19, 2018 .Dt SETGROUPS 2 .Os .Sh NAME @@ -56,6 +56,23 @@ more than .Dv {NGROUPS_MAX}+1 . .Pp Only the super-user may set a new group list. +.Pp +The first entry of the group array +.Pq Va gidset[0] +is used as the effective group-ID for the process. +This entry is over-written when a setgid program is run. +To avoid losing access to the privileges of the +.Va gidset[0] +entry, it should be duplicated later in the group array. +By convention, +this happens because the group value indicated +in the password file also appears in +.Pa /etc/group . +The group value in the password file is placed in +.Va gidset[0] +and that value then gets added a second time when the +.Pa /etc/group +file is scanned to create the group set. .Sh RETURN VALUES .Rv -std setgroups .Sh ERRORS |
