)]}'
{
  "commit": "aa2733382e4ae7b8950a68a1fce5c533bf58c2e1",
  "tree": "65225a828b9362699c8cdf9ed1267de979bda9c7",
  "parents": [
    "88053041260a6090061693d4b98d083ec3d907c4"
  ],
  "author": {
    "name": "mohammadmseet-hue",
    "email": "mohammadmseet@fuchsia.infra.roller.gmail.com",
    "time": "Mon Apr 27 13:17:40 2026 -0700"
  },
  "committer": {
    "name": "Copybara-Service",
    "email": "copybara-worker@google.com",
    "time": "Mon Apr 27 13:18:28 2026 -0700"
  },
  "message": "[roll] Roll fuchsia [starnix] Fix setreuid/setregid accepting saved_uid/saved_gid for ruid/rgid\n\nLinux\u0027s __sys_setreuid() uses asymmetric permission checks for its two\narguments: ruid can only be set to the current real UID or effective UID,\nwhile euid can additionally be set to saved_uid. This asymmetry is\nintentional — it prevents a process that dropped privileges from regaining\nroot via setreuid when the more explicit setresuid would be required.\n\nStarnix used a shared new_uid_allowed() check for both arguments, which\nalso accepts saved_uid. This allowed setreuid(saved_uid, -1) to succeed\nwhere Linux returns EPERM, enabling a privilege escalation path:\n\n  setresuid(1000, 1000, 0)  // drop privileges, keep saved_uid\u003d0\n  setreuid(0, -1)           // Linux: EPERM. Starnix: success → uid\u003d0\n  setreuid(0, 0)            // full root restored\n\nFix: Add setreuid_ruid_allowed() and setregid_rgid_allowed() functions\nthat exclude saved_uid/saved_gid, matching Linux\u0027s permission model.\n\nThe existing new_uid_allowed() remains correct for setresuid (which\nallows saved_uid for all three arguments) and for setreuid\u0027s euid.\n\nSecurity: Local privilege escalation in Starnix credential management.\nOriginal-Reviewed-on: https://fuchsia-review.googlesource.com/c/fuchsia/+/1575713\nOriginal-Revision: 611de8538f6ae050d01be737e2581acc7fe14166\nGitOrigin-RevId: 32172471289af444938aa62186c385431cbbd14b\nChange-Id: I91954eb88bd6a777a78cfc21e095b1227bf5c42f\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "7ba360fe38d9a7fbf50e25144b7185fafbd80f84",
      "old_mode": 33188,
      "old_path": "stem",
      "new_id": "be39ac06bd992800e5996da5926beda1c6d0d8af",
      "new_mode": 33188,
      "new_path": "stem"
    }
  ]
}