also drop supplementary groups

diff --git a/citadel/ChangeLog b/citadel/ChangeLog
index 99b2434929b141bc10440a847737a9675977b056..85ce83b8d86f4c5c0e11f38e86d5f77e6f4a2033 100644 (file)
--- a/citadel/ChangeLog
+++ b/citadel/ChangeLog
@@ -1,6 +1,7 @@
 1999-03-05 Nathan Bryant <bryant@cs.usm.maine.edu>
        * sysdep.c: add undocumented -r flag to citserver to prevent it from
          dropping root permissions.
+       * sysdep.c: also drop supplementary groups
 
 1999-03-04 Nathan Bryant <bryant@cs.usm.maine.edu>
        * config.c: error checking in put_config()

diff --git a/citadel/sysdep.c b/citadel/sysdep.c
index ccfb24660e990f5c3b70122dd217f6a1bc924a72..18e66b9f3c1cfb6b94cd703d93323701f41c1adf 100644 (file)
--- a/citadel/sysdep.c
+++ b/citadel/sysdep.c
@@ -33,6 +33,7 @@
 #include <errno.h>
 #include <stdarg.h>
 #include <syslog.h>
+#include <grp.h>
 #ifdef HAVE_PTHREAD_H
 #include <pthread.h>
 #endif
@@ -852,15 +853,21 @@ int main(int argc, char **argv)
 
        /*
         * Now that we've bound the socket, change to the BBS user id and its
-        * corresponding group id
+        * corresponding group ids
         */
        if (drop_root_perms) {
                if ((pw = getpwuid(BBSUID)) == NULL)
-                       lprintf(1, "getpwuid(%d): %s\n", BBSUID,
-                               strerror(errno));
-               else if (setgid(pw->pw_gid))
-                       lprintf(3, "setgid(%d): %s\n", pw->pw_gid,
+                       lprintf(1, "WARNING: getpwuid(%d): %s\n"
+                                  "Group IDs will be incorrect.\n", BBSUID,
                                strerror(errno));
+               else {
+                       if (initgroups(pw->pw_name, pw->pw_gid))
+                               lprintf(3, "initgroups(): %s\n",
+                                       strerror(errno));
+                       if (setgid(pw->pw_gid))
+                               lprintf(3, "setgid(%d): %s\n", pw->pw_gid,
+                                       strerror(errno));
+                       }
                lprintf(7, "Changing uid to %d\n", BBSUID);
                if (setuid(BBSUID) != 0) {
                        lprintf(3, "setuid() failed: %s\n", strerror(errno));