From 799361e237fdb276321038f0ef7f547ad2a0a863 Mon Sep 17 00:00:00 2001 From: jamie Date: Sat, 27 Dec 2014 02:17:35 +0000 Subject: MFC r275906: Setgid before running a command as a specified user. Previously only initgroups(3) was called, what isn't quite enough. This brings jail(8) in line with jexec(8), which was already doing the right thing. PR: 195984 --- usr.sbin/jail/command.c | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'usr.sbin/jail') diff --git a/usr.sbin/jail/command.c b/usr.sbin/jail/command.c index 0d1c898..390be80 100644 --- a/usr.sbin/jail/command.c +++ b/usr.sbin/jail/command.c @@ -668,6 +668,11 @@ run_command(struct cfjail *j) if (term != NULL) setenv("TERM", term, 1); } + if (setgid(pwd->pw_gid) < 0) { + jail_warnx(j, "setgid %d: %s", pwd->pw_gid, + strerror(errno)); + exit(1); + } if (setusercontext(lcap, pwd, pwd->pw_uid, username ? LOGIN_SETALL & ~LOGIN_SETGROUP & ~LOGIN_SETLOGIN : LOGIN_SETPATH | LOGIN_SETENV) < 0) { -- cgit v1.1