git: 4750f117a060 - releng/14.0 - New realgroupmember()

The branch releng/14.0 has been updated by mhorne:

URL: https://cgit.FreeBSD.org/src/commit/?id=4750f117a060c835c327aebf8e76ba6abeef16e5

commit 4750f117a060c835c327aebf8e76ba6abeef16e5
Author:     Olivier Certner <olce.freebsd@certner.fr>
AuthorDate: 2023-08-17 23:54:45 +0000
Commit:     Mitchell Horne <mhorne@FreeBSD.org>
CommitDate: 2023-10-18 18:01:44 +0000

    New realgroupmember()
    
    Like groupmember(), but taking into account the real group instead of
    the effective group.  Leverages the new supplementary_group_member()
    function.
    
    Approved by:            re (gjb)
    Reviewed by:            mhorne
    Sponsored by:           Kumacom SAS
    Differential Revision:  https://reviews.freebsd.org/D40641
    Differential Revision:  https://reviews.freebsd.org/D40643
    
    (cherry picked from commit 2a2bfa6ad92e9c82dcc55733ad2fd58fd2ea7559)
    (cherry picked from commit 5d9f38405a10fdcd9fc108c940dcf2642e9f1833)
    (cherry picked from commit cbe88592ab88c3940bedc3b2a651eb4556f4bbd8)
---
 share/man/man9/Makefile      |  1 +
 share/man/man9/groupmember.9 |  7 +++++++
 sys/kern/kern_prot.c         | 13 +++++++++++++
 sys/sys/ucred.h              |  1 +
 4 files changed, 22 insertions(+)

diff --git a/share/man/man9/Makefile b/share/man/man9/Makefile
index c3c81719b7d2..2122f8d6ea8c 100644
--- a/share/man/man9/Makefile
+++ b/share/man/man9/Makefile
@@ -1157,6 +1157,7 @@ MLINKS+=g_provider.9 g_destroy_provider.9 \
 	g_provider.9 g_error_provider.9 \
 	g_provider.9 g_new_providerf.9
 MLINKS+=gone_in.9 gone_in_dev.9
+MLINKS+=groupmember.9 realgroupmember.9
 MLINKS+=hash.9 hash32.9 \
 	hash.9 hash32_buf.9 \
 	hash.9 hash32_str.9 \
diff --git a/share/man/man9/groupmember.9 b/share/man/man9/groupmember.9
index 3a516622efce..ae7ccd477955 100644
--- a/share/man/man9/groupmember.9
+++ b/share/man/man9/groupmember.9
@@ -36,6 +36,8 @@
 .In sys/ucred.h
 .Ft int
 .Fn groupmember "gid_t gid" "struct ucred *cred"
+.Ft int
+.Fn realgroupmember "gid_t gid" "struct ucred *cred"
 .Sh DESCRIPTION
 The
 .Fn groupmember
@@ -49,6 +51,11 @@ Considered groups in
 .Fa cred
 are the effective and supplementary groups.
 The real group is not taken into account.
+.Pp
+Function
+.Fn realgroupmember
+works the same except that it considers instead the real and supplementary
+groups, and not the effective one.
 .Sh RETURN VALUES
 If the
 .Fa gid
diff --git a/sys/kern/kern_prot.c b/sys/kern/kern_prot.c
index 21f5e5d3bc16..23bd2009582b 100644
--- a/sys/kern/kern_prot.c
+++ b/sys/kern/kern_prot.c
@@ -1312,6 +1312,19 @@ groupmember(gid_t gid, struct ucred *cred)
 	return (supplementary_group_member(gid, cred));
 }
 
+/*
+ * Check if gid is a member of the real group set (i.e., real and supplementary
+ * groups).
+ */
+int
+realgroupmember(gid_t gid, struct ucred *cred)
+{
+	if (gid == cred->cr_rgid)
+		return (1);
+
+	return (supplementary_group_member(gid, cred));
+}
+
 /*
  * Test the active securelevel against a given level.  securelevel_gt()
  * implements (securelevel > level).  securelevel_ge() implements
diff --git a/sys/sys/ucred.h b/sys/sys/ucred.h
index eb92776c158a..633bf436fcd4 100644
--- a/sys/sys/ucred.h
+++ b/sys/sys/ucred.h
@@ -159,6 +159,7 @@ void	cru2x(struct ucred *cr, struct xucred *xcr);
 void	cru2xt(struct thread *td, struct xucred *xcr);
 void	crsetgroups(struct ucred *cr, int n, gid_t *groups);
 int	groupmember(gid_t gid, struct ucred *cred);
+int	realgroupmember(gid_t gid, struct ucred *cred);
 #endif /* _KERNEL */
 
 #endif /* !_SYS_UCRED_H_ */