* [PATCH 1/1] rpcbind: drop supplemental groups
@ 2012-03-08 14:37 Steve Dickson
2012-03-08 20:55 ` Steve Dickson
0 siblings, 1 reply; 2+ messages in thread
From: Steve Dickson @ 2012-03-08 14:37 UTC (permalink / raw)
To: Linux NFS Mailing list
Drop out of the 'root' group to ensure the process does
not have any access to writable or readable files
to that group.
Signed-off-by: Steve Dickson <steved@redhat.com>
---
src/rpcbind.c | 4 ++++
1 files changed, 4 insertions(+), 0 deletions(-)
diff --git a/src/rpcbind.c b/src/rpcbind.c
index 24e069b..9a0504d 100644
--- a/src/rpcbind.c
+++ b/src/rpcbind.c
@@ -236,6 +236,10 @@ main(int argc, char *argv[])
syslog(LOG_ERR, "setgid to '%s' (%d) failed: %m", id, p->pw_gid);
exit(1);
}
+ if (setgroups(0, NULL) == -1) {
+ syslog(LOG_ERR, "dropping supplemental groups failed: %m");
+ exit(1);
+ }
if (setuid(p->pw_uid) == -1) {
syslog(LOG_ERR, "setuid to '%s' (%d) failed: %m", id, p->pw_uid);
exit(1);
--
1.7.7.6
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [PATCH 1/1] rpcbind: drop supplemental groups
2012-03-08 14:37 [PATCH 1/1] rpcbind: drop supplemental groups Steve Dickson
@ 2012-03-08 20:55 ` Steve Dickson
0 siblings, 0 replies; 2+ messages in thread
From: Steve Dickson @ 2012-03-08 20:55 UTC (permalink / raw)
To: Steve Dickson; +Cc: Linux NFS Mailing list
On 03/08/2012 09:37 AM, Steve Dickson wrote:
> Drop out of the 'root' group to ensure the process does
> not have any access to writable or readable files
> to that group.
>
> Signed-off-by: Steve Dickson <steved@redhat.com>
Committed....
steved.
> ---
> src/rpcbind.c | 4 ++++
> 1 files changed, 4 insertions(+), 0 deletions(-)
>
> diff --git a/src/rpcbind.c b/src/rpcbind.c
> index 24e069b..9a0504d 100644
> --- a/src/rpcbind.c
> +++ b/src/rpcbind.c
> @@ -236,6 +236,10 @@ main(int argc, char *argv[])
> syslog(LOG_ERR, "setgid to '%s' (%d) failed: %m", id, p->pw_gid);
> exit(1);
> }
> + if (setgroups(0, NULL) == -1) {
> + syslog(LOG_ERR, "dropping supplemental groups failed: %m");
> + exit(1);
> + }
> if (setuid(p->pw_uid) == -1) {
> syslog(LOG_ERR, "setuid to '%s' (%d) failed: %m", id, p->pw_uid);
> exit(1);
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2012-03-08 20:55 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-03-08 14:37 [PATCH 1/1] rpcbind: drop supplemental groups Steve Dickson
2012-03-08 20:55 ` Steve Dickson
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox