Re: git-daemon --inetd

["H. Peter Anvin" <hpa@zytor.com>]

Linus Torvalds wrote:
> 
> Well, the symbolic names are much nicer and more readable. So it would be 
> better to do the uid/gid translation early, and change the "chroot" thing 
> to be done after all that.
> 
> It gets a bit messy.. Easy enough to just save a "const char *new_root",
> but then you have to split up the "set_user_group()" to be two functions,
> around the actual chroot(), since the chroot needs to be done while we're
> still root.
> 

Actually, initgroups() and setgroups(), and setgid() for that matter, 
can be done before the chroot().  The only thing that needs to remain 
until the end is setuid().

At one time I played around in tftp-hpa with trying to get Linux to keep 
only CAP_SYS_CHROOT around, but I think I gave up on it.  The way Linux 
capabilities play with the rest of the permission system isn't very 
useful :(

	-hpa