mac_do(4): Enhance GID rule validation to check all groups in cr_groups

[lwhsu]

Summary

Previously, the rule validation only checked the primary GID (cr_gid)
This caused issues when applying GID-based rules, as users with matching
secondary groups were not considered valid. This patch modifies both
functions to iterate through all groups in cr_groups to ensure all group
memberships are considered when validating GID-based rules.

For example, an user's primary group is staff (20) and is also in the
wheel (0) group, with this change, the rule gid=0:any works for enabling
them to run command as any user.

[delphij]

I think code should be using groupmember(9) instead of rolling our own.

sys/security/mac_do/mac_do.c

416–418

Maybe just:

if (groupmember(r->f_gid, cred))
    return (true);

?

527

The matching should use groupmember(), e.g.:

if (groupmember(r->f_gid, cred)) {
    if (r->to_type == RULE_ANY || (r->to_type == RULE_UID && uid == r->t_uid))
        error = 0;
        break;
    }
}

[lwhsu]

Use groupmember(9)

[lwhsu]

Trim sneaked added empty line