git: ab7186a48634 - main - MAC/bsdextended: Restore matching subjects' effective GID

The branch main has been updated by olce:

URL: https://cgit.FreeBSD.org/src/commit/?id=ab7186a486347216fde099498471cf847828565c

commit ab7186a486347216fde099498471cf847828565c
Author:     Olivier Certner <olce@FreeBSD.org>
AuthorDate: 2025-08-27 14:56:21 +0000
Commit:     Olivier Certner <olce@FreeBSD.org>
CommitDate: 2025-09-17 12:16:03 +0000

    MAC/bsdextended: Restore matching subjects' effective GID
    
    Fixes:          be1f7435ef218b1d ("kern: start tracking cr_gid outside of cr_groups[]")
    MFC after:      5 days
    MFC to:         stable/15
    Sponsored by:   The FreeBSD Foundation
    Differential Revision:  https://reviews.freebsd.org/D52270
---
 sys/security/mac_bsdextended/mac_bsdextended.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/sys/security/mac_bsdextended/mac_bsdextended.c b/sys/security/mac_bsdextended/mac_bsdextended.c
index 8a6549214380..bf95c008e2f2 100644
--- a/sys/security/mac_bsdextended/mac_bsdextended.c
+++ b/sys/security/mac_bsdextended/mac_bsdextended.c
@@ -246,7 +246,9 @@ ugidfw_rulecheck(struct mac_bsdextended_rule *rule,
 	}
 
 	if (rule->mbr_subject.mbs_flags & MBS_GID_DEFINED) {
-		match = ((cred->cr_rgid <= rule->mbr_subject.mbs_gid_max &&
+		match = ((cred->cr_gid <= rule->mbr_subject.mbs_gid_max &&
+		    cred->cr_gid >= rule->mbr_subject.mbs_gid_min) ||
+		    (cred->cr_rgid <= rule->mbr_subject.mbs_gid_max &&
 		    cred->cr_rgid >= rule->mbr_subject.mbs_gid_min) ||
 		    (cred->cr_svgid <= rule->mbr_subject.mbs_gid_max &&
 		    cred->cr_svgid >= rule->mbr_subject.mbs_gid_min));