en Copyright 2015 Java http://kernelsources.org:8080/source/history/freebsd/tests/sys/mac/do/regression.c#96bf349029d495c6aa2d67efc14b24aad7989e3b cred: Fix group_is_primary()This helper wasn't updated in commit be1f7435ef21, so in reality it wastesting whether "gid" is the first supplemental group. If a userdoesn't belong to a supplementary group, then it's testing anuninitialized slot; since ucreds are allocated with M_ZERO, thistypically means that we're testing gid == 0.group_is_primary() has exactly one use, in mac_do. There, it's used todetermine whether the requested primary GID can be used in a setcred(2)call when the ruleset does not explicitly specify a target primary GID.I believe this is mostly exploitable by daemons which have explicitlydropped privileges and called setgroups(0, NULL); logged in users willhave a non-empty supplementary group list by virtue of having gonethrough initgroups(3).Fix group_is_primary(), and add a regression test.Approved by: soSecurity: FreeBSD-SA-26:59.mac_doSecurity: CVE-2026-58092Reported by: Hazley Samsudin of GovTech CSGFixes: be1f7435ef21 ("kern: start tracking cr_gid outside of cr_groups[]")Reviewed by: olce, kevansSponsored by: The FreeBSD FoundationDifferential Revision: https://reviews.freebsd.org/D59051 List of files: /freebsd/tests/sys/mac/do/regression.c Mon, 24 Aug 2026 20:13:29 +0200 Mark Johnston <markj@FreeBSD.org>