From 2b79f7b494c2be2d94f07dad5ceb0a91d73052ed Mon Sep 17 00:00:00 2001
From: Augustin Cavalier <waddlesplash@gmail.com>
Date: Tue, 15 Jul 2025 18:08:00 -0400
Subject: [PATCH] kernel/team: Add permissions checks in
 get_extended_team_info.

---
 src/system/kernel/team.cpp | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/src/system/kernel/team.cpp b/src/system/kernel/team.cpp
index c7dfb1339d..27e112d82c 100644
--- a/src/system/kernel/team.cpp
+++ b/src/system/kernel/team.cpp
@@ -4456,6 +4456,15 @@ _user_get_extended_team_info(team_id teamID, uint32 flags, void* buffer,
 		return B_BAD_ADDRESS;
 	}
 
+	Team* team = Team::Get(teamID);
+	if (team == NULL)
+		return B_BAD_TEAM_ID;
+	BReference<Team> teamReference(team, true);
+
+	uid_t uid = geteuid();
+	if (uid != 0 && uid != team->effective_uid)
+		return B_NOT_ALLOWED;
+
 	KMessage info;
 
 	if ((flags & B_TEAM_INFO_BASIC) != 0) {
@@ -4473,12 +4482,7 @@ _user_get_extended_team_info(team_id teamID, uint32 flags, void* buffer,
 
 		io_context* ioContext;
 		{
-			// get the team structure
-			Team* team = Team::GetAndLock(teamID);
-			if (team == NULL)
-				return B_BAD_TEAM_ID;
-			BReference<Team> teamReference(team, true);
-			TeamLocker teamLocker(team, true);
+			TeamLocker teamLocker(team);
 
 			// copy the data
 			teamClone.id = team->id;