diff options
| author | Steve Dickson <steved@redhat.com> | 2012-03-08 09:13:36 -0500 |
|---|---|---|
| committer | Steve Dickson <steved@redhat.com> | 2012-03-08 15:53:41 -0500 |
| commit | d94d9d1cddb0757fc2d290c64984276edae51ff2 (patch) | |
| tree | 0e7fadbd0798ca551bc0e5e81fccee758ce5fe48 | |
| parent | 1d9fba5b631b517094c85a80f45f6f7ba1665e2a (diff) | |
| download | rpcbind-d94d9d1cddb0757fc2d290c64984276edae51ff2.tar.gz | |
rpcbind: drop supplemental groups
Drop out of the 'root' group to ensure the process does
not have any access to writable or readable files
to that group.
Signed-off-by: Steve Dickson <steved@redhat.com>
| -rw-r--r-- | src/rpcbind.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/src/rpcbind.c b/src/rpcbind.c index 24e069b..9a0504d 100644 --- a/src/rpcbind.c +++ b/src/rpcbind.c @@ -236,6 +236,10 @@ main(int argc, char *argv[]) syslog(LOG_ERR, "setgid to '%s' (%d) failed: %m", id, p->pw_gid); exit(1); } + if (setgroups(0, NULL) == -1) { + syslog(LOG_ERR, "dropping supplemental groups failed: %m"); + exit(1); + } if (setuid(p->pw_uid) == -1) { syslog(LOG_ERR, "setuid to '%s' (%d) failed: %m", id, p->pw_uid); exit(1); |