git: 9722023c4875 - stable/14 - MAC/do: allow to call setuid if real user id is 0

The branch stable/14 has been updated by bapt:

URL: https://cgit.FreeBSD.org/src/commit/?id=9722023c4875a326ee9e4e9e0db71d463d990368

commit 9722023c4875a326ee9e4e9e0db71d463d990368
Author:     Baptiste Daroussin <bapt@FreeBSD.org>
AuthorDate: 2024-05-23 10:09:11 +0000
Commit:     Baptiste Daroussin <bapt@FreeBSD.org>
CommitDate: 2024-06-27 08:47:06 +0000

    MAC/do: allow to call setuid if real user id is 0
    
    This fixed sshd not able to call restore_uid when MAC/do policy is
    loaded
    
    (cherry picked from commit 61b07f8aa52844b21637ac264ea134c1aef48cb7)
---
 sys/security/mac_do/mac_do.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sys/security/mac_do/mac_do.c b/sys/security/mac_do/mac_do.c
index 8685954b7db6..507e64ea0175 100644
--- a/sys/security/mac_do/mac_do.c
+++ b/sys/security/mac_do/mac_do.c
@@ -489,7 +489,7 @@ check_setuid(struct ucred *cred, uid_t uid)
 
 	if (do_enabled == 0)
 		return (0);
-	if (cred->cr_uid == uid || cred->cr_uid == 0)
+	if (cred->cr_uid == uid || cred->cr_uid == 0 || cred->cr_ruid == 0)
 		return (0);
 
 	if (vn_fullpath(curproc->p_textvp, &fullpath, &freebuf) != 0)