git: ab2f2f1f75c0 - stable/15 - MAC/do: Fix reporting of "mac.do" post-"executable paths"

The branch stable/15 has been updated by olce:

URL: https://cgit.FreeBSD.org/src/commit/?id=ab2f2f1f75c0617963fdc745ecffbcfa4f2854ec

commit ab2f2f1f75c0617963fdc745ecffbcfa4f2854ec
Author:     Olivier Certner <olce@FreeBSD.org>
AuthorDate: 2026-04-28 13:17:18 +0000
Commit:     Olivier Certner <olce@FreeBSD.org>
CommitDate: 2026-06-29 19:23:51 +0000

    MAC/do: Fix reporting of "mac.do" post-"executable paths"
    
    In mac_do_jail_get(), computation of 'jsys' had not been updated to take
    into account executable paths.
    
    Reviewed by:    bapt
    Fixes:          9818224174c4 ("MAC/do: Executable paths feature (GSoC 2025's final state)")
    MFC after:      1 month
    Sponsored by:   The FreeBSD Foundation
    Pull Request:   https://ron-dev.freebsd.org/FreeBSD/src/pulls/38
    
    (cherry picked from commit 888a84ceeded9ef69903e352827cdef58163027e)
---
 sys/security/mac_do/mac_do.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/sys/security/mac_do/mac_do.c b/sys/security/mac_do/mac_do.c
index 33e655a854a4..f298ad2d4f59 100644
--- a/sys/security/mac_do/mac_do.c
+++ b/sys/security/mac_do/mac_do.c
@@ -1562,9 +1562,8 @@ mac_do_jail_get(void *obj, void *data)
 	const struct exec_paths *const exec_paths = &applicable_conf->exec_paths;
 	int jsys, error;
 
-	jsys = hpr == pr ?
-	    (STAILQ_EMPTY(&rules->head) ? JAIL_SYS_DISABLE : JAIL_SYS_NEW) :
-	    JAIL_SYS_INHERIT;
+	jsys = hpr == pr ? (has_rules(rules) && has_exec_paths(exec_paths) ?
+	    JAIL_SYS_NEW : JAIL_SYS_DISABLE) : JAIL_SYS_INHERIT;
 
 	error = vfs_setopt(opts, "mac.do", &jsys, sizeof(jsys));
 	if (error != 0 && error != ENOENT)