svn commit: r276276 - stable/9/usr.sbin/jail

[Jamie Gritton]

Author: jamie
Date: Sat Dec 27 02:17:35 2014
New Revision: 276276
URL: https://svnweb.freebsd.org/changeset/base/276276

Log:
  MFC r275906:
  
    Setgid before running a command as a specified user.  Previously only
    initgroups(3) was called, what isn't quite enough.  This brings jail(8)
    in line with jexec(8), which was already doing the right thing.
  
  PR:		195984

Modified:
  stable/9/usr.sbin/jail/command.c
Directory Properties:
  stable/9/usr.sbin/jail/   (props changed)

Modified: stable/9/usr.sbin/jail/command.c
==============================================================================
--- stable/9/usr.sbin/jail/command.c	Sat Dec 27 01:35:03 2014	(r276275)
+++ stable/9/usr.sbin/jail/command.c	Sat Dec 27 02:17:35 2014	(r276276)
@@ -591,6 +591,11 @@ run_command(struct cfjail *j)
 			if (term != NULL)
 				setenv("TERM", term, 1);
 		}
+		if (setgid(pwd->pw_gid) < 0) {
+			jail_warnx(j, "setgid %d: %s", pwd->pw_gid,
+			    strerror(errno));
+			exit(1);
+		}
 		if (setusercontext(lcap, pwd, pwd->pw_uid, username
 		    ? LOGIN_SETALL & ~LOGIN_SETGROUP & ~LOGIN_SETLOGIN
 		    : LOGIN_SETPATH | LOGIN_SETENV) < 0) {