From c8b8247f70607073af241f4aba682f09ccb3e76d Mon Sep 17 00:00:00 2001 From: Gaudenz Steinlin Date: Mon, 9 Sep 2013 08:33:48 +0200 Subject: [BB#115] Drop supplementary groups Supplementary groups are inherited from the calling process. Drop all supplementary groups if the "Group" configuration directive is set to change to a different user. Otherwise the process may have more rights than expected. Reviewed-by: Michael Adam --- src/main.c | 10 ++++++++++ 1 file changed, 10 insertions(+) (limited to 'src') diff --git a/src/main.c b/src/main.c index a7ae9c7..abb047d 100644 --- a/src/main.c +++ b/src/main.c @@ -296,6 +296,16 @@ change_user (const char *program) exit (EX_NOPERM); } +#ifdef HAVE_SETGROUPS + /* Drop all supplementary groups, otherwise these are inherited from the calling process */ + if (setgroups (0, NULL) < 0) { + fprintf (stderr, + "%s: Unable to drop supplementary groups.\n", + program); + exit (EX_NOPERM); + } +#endif + log_message (LOG_INFO, "Now running as group \"%s\".", config.group); } -- cgit v1.2.3