From c3fc945d1f33733e94a485f48a0b963979642b78 Mon Sep 17 00:00:00 2001 From: Luiz Angelo Daros de Luca Date: Thu, 3 Jul 2014 17:52:07 -0300 Subject: [PATCH] added setgroups before setuid --- base.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/base.c b/base.c index b04959f3..167e3b78 100644 --- a/base.c +++ b/base.c @@ -392,6 +392,11 @@ static int base_init() } if (instance.user) { + /* This executable is calling setuid and setgid without setgroups or initgroups. + * There is a high probability this mean it didn't relinquish all groups, and + * this would be a potential security issue to be fixed. Seek POS36-C on the web + * for details about the problem. */ + setgroups(0, NULL); if (setuid(uid) < 0) { log_errno(LOG_ERR, "setuid(%i)", uid); goto fail;