From nobody Thu Nov 06 23:11:56 2025 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4d2dHc659Gz6FtNm; Thu, 06 Nov 2025 23:11:56 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R12" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4d2dHc56Wtz3h14; Thu, 06 Nov 2025 23:11:56 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1762470716; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=9Kq35j1Jq7NmEGsZ8cyLPdp+VNbNLmGnQ2cFoRqg+QA=; b=dFnYKmHScnHHOFHY7yyuXdnQwqnsng10DkqV+YAbzKVp5PhC9nsNLJwdn/OPXnmUl4NJ3A F9LOObHFfB5HAOuOWJhM0vRPT/Nl+4z8pSFP4+UzAs5jY8M9BUEc5UQQFNUULqChTycBxj LEok7Zd/roae+3UihBfNxLzua791t2tltoUy3YTK5VtdwthaMGBURmh/zaZqbr2/EO940D LPrkEede0rJIJrjm9ZhP/a9Qzfp4liGNNhmIPC4E1kJMfID5bSkaEnV/P6VQGiQILzS4h+ HxQUtcEQ3quVqDF0pY6Zbs52q0AHfk2Ng6OGnIQDfGGhMXez1LajKBSIPbECLQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1762470716; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=9Kq35j1Jq7NmEGsZ8cyLPdp+VNbNLmGnQ2cFoRqg+QA=; b=PNmCzomLrG1jKAvR6mZu8OIA9fbZF4Xq2TV9F2Rh7U4uTwravrfXK+HMDJzc/rMMysZX7W nCuw2bMRLdScIBwRJzvrEtvKHTI3Oe7sLXdq3R8e22B9kPdS6Ef45PtvZh4bUtU5xp3FwX o6JBTBiakRjdtUk8vOmsOB6YdPWrDGE571kjEBJP4iQ3YIb1h7qMJVxW2pDN1105A5DTAX 5gq3K2fz+aiult2LzB/NiF1I+O9gABdklgUtJu0mVSlc8MWXqfFhJYw0mqahhM8D5hh/l1 4FGCmvneoDqe+/C23cNKsBRPMo+z3aFJcXMJSA7snqfCWZDNEm2mobit9ti1Ag== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1762470716; a=rsa-sha256; cv=none; b=jGdNNc2MgXgePjuJwG1t9VIpotyveJWgmqxKEkXREYZ8Qa2vzOZbTqQka09kcJOhSXHRZW teHS3HtxV2kMwj4PBS1DCs4XTLEtXjTYCODdC2X089b+nGGEr2N8nNk90Jev88s3BNtZbs B6Dx4NkAJ44Ualg7HmFwTh7WTSKEfMl13plmr8Y/QuEw3gqrN2KVvZDmycfud4BCOa4a1V wJ4H4oPiozTjOrzArQYjpEeaTECWvgjE7XVfyCOR5zlLeM0jKO0qdbpm4SNGXe2oC23/uL 9Acz2IX3W8SH0CV0cWTvpNGoRZGrQDMdgrvRjY7XT3Ttjv6ELvKO6dpCdx5fTg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4d2dHc4YsWzbCK; Thu, 06 Nov 2025 23:11:56 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 5A6NBunO010551; Thu, 6 Nov 2025 23:11:56 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 5A6NBulc010548; Thu, 6 Nov 2025 23:11:56 GMT (envelope-from git) Date: Thu, 6 Nov 2025 23:11:56 GMT Message-Id: <202511062311.5A6NBulc010548@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Colin Percival Subject: git: 76fb5c23dcca - releng/15.0 - setcred(): Fix RACCT resource accounting on credentials change List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: cperciva X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.0 X-Git-Reftype: branch X-Git-Commit: 76fb5c23dcca4696d3682bec2dd0e60d81c6db1e Auto-Submitted: auto-generated The branch releng/15.0 has been updated by cperciva: URL: https://cgit.FreeBSD.org/src/commit/?id=76fb5c23dcca4696d3682bec2dd0e60d81c6db1e commit 76fb5c23dcca4696d3682bec2dd0e60d81c6db1e Author: Olivier Certner AuthorDate: 2025-10-29 17:07:59 +0000 Commit: Colin Percival CommitDate: 2025-11-06 23:11:10 +0000 setcred(): Fix RACCT resource accounting on credentials change When credentials are changed, we need to adjust the sum of resources associated to the initial and new process' user IDs (and old and new login classes and jails, but setcred() does not change them) for them to stay consistent. Approved by: re (cperciva) PR: 290352 MFC after: 3 days Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D53457 (cherry picked from commit 2be5127c4a31bacac9b4158395bfa844f6033626) (cherry picked from commit 2e76660cb71dc113a4f4e0eb05eb190d7fc99e7f) --- sys/kern/kern_prot.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/sys/kern/kern_prot.c b/sys/kern/kern_prot.c index df725cfebd97..3c145851b683 100644 --- a/sys/kern/kern_prot.c +++ b/sys/kern/kern_prot.c @@ -696,7 +696,7 @@ kern_setcred(struct thread *const td, const u_int flags, gid_t *groups = NULL; gid_t smallgroups[CRED_SMALLGROUPS_NB]; int error; - bool cred_set; + bool cred_set = false; /* Bail out on unrecognized flags. */ if (flags & ~SETCREDF_MASK) @@ -839,17 +839,32 @@ kern_setcred(struct thread *const td, const u_int flags, if (cred_set) { setsugid(p); to_free_cred = old_cred; +#ifdef RACCT + racct_proc_ucred_changed(p, old_cred, new_cred); +#endif +#ifdef RCTL + crhold(new_cred); +#endif MPASS(error == 0); } else error = EAGAIN; unlock_finish: PROC_UNLOCK(p); + /* * Part 3: After releasing the process lock, we perform cleanups and * finishing operations. */ +#ifdef RCTL + if (cred_set) { + rctl_proc_ucred_changed(p, new_cred); + /* Paired with the crhold() just above. */ + crfree(new_cred); + } +#endif + #ifdef MAC if (mac_set_proc_data != NULL) mac_set_proc_finish(td, proc_label_set, mac_set_proc_data);