Attachment 677460 Details for Bug 894626 – patch to reset group membership

[patch] patch to reset group membership

0001-add-a-call-to-initgroups-when-changing-uid-and-gid.patch (text/plain), 2.22 KB, created by Michael S. on 2013-01-12 18:37:54 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Michael S.

Created: 2013-01-12 18:37:54 UTC

Size: 2.22 KB

patch

obsolete

>From 5de282348784332e8ef78717a2ad36f537a821fd Mon Sep 17 00:00:00 2001
>From: Michael Scherer <misc@zarb.org>
>Date: Sat, 12 Jan 2013 18:35:19 +0100
>Subject: [PATCH] add a call to initgroups when changing uid and gid.
>
>Without it, haproxy will retain the group membership of root, which may
>give more access than intended to the process. For example, haproxy would
>still be in the wheel group on Fedora 18, as seen with :
>
>  # haproxy -f /etc/haproxy/haproxy.cfg
>
>  # ps a -o pid,user,group,command | grep hapr
>  3545 haproxy  haproxy  haproxy -f /etc/haproxy/haproxy.cfg
>  4356 root     root     grep --color=auto hapr
>  # grep Group /proc/3545/status
>  Groups: 0 1 2 3 4 6 10
>  # getent group wheel
>  wheel:x:10:root,misc
>---
> src/haproxy.c | 21 +++++++++++++++++++++
> 1 file changed, 21 insertions(+)
>
>diff --git a/src/haproxy.c b/src/haproxy.c
>index 0d826d2..52fef1e 100644
>--- a/src/haproxy.c
>+++ b/src/haproxy.c
>@@ -44,6 +44,8 @@
> #include <sys/resource.h>
> #include <time.h>
> #include <syslog.h>
>+#include <pwd.h>
>+#include <grp.h>
> #ifdef USE_CPU_AFFINITY
> #define __USE_GNU
> #include <sched.h>
>@@ -1241,6 +1243,7 @@ int main(int argc, char **argv)
> 	struct rlimit limit;
> 	char errmsg[100];
> 	int pidfd = -1;
>+	struct passwd *user = NULL;
> 
> 	init(argc, argv);
> 	signal_register_fct(SIGQUIT, dump, SIGQUIT);
>@@ -1389,6 +1392,16 @@ int main(int argc, char **argv)
> 		exit(1);
> 	}
> 
>+	// need to be done before chroot, since there is no /etc/group after chroot
>+	if (global.uid) {
>+		user = getpwuid(global.uid);
>+		if (user == NULL) {
>+			Alert("[%s.main()] Cannot get user info for %d, error : %s\n", argv[0], global.uid, strerror(errno));
>+			protocol_unbind_all();
>+			exit(1);
>+		}
>+	}
>+
> 	/* If the user is not root, we'll still let him try the configuration
> 	 * but we inform him that unexpected behaviour may occur.
> 	 */
>@@ -1422,6 +1435,14 @@ int main(int argc, char **argv)
> 		exit(1);
> 	}
> 
>+	if (user && global.gid) {
>+		if (initgroups(user->pw_name, user->pw_gid) == -1) {
>+			Alert("[%s.main()] Cannot initgroups for %d.\n", argv[0], global.uid);
>+			protocol_unbind_all();
>+			exit(1);
>+		}
>+	}
>+
> 	if (global.uid && setuid(global.uid) == -1) {
> 		Alert("[%s.main()] Cannot set uid %d.\n", argv[0], global.uid);
> 		protocol_unbind_all();
>-- 
>1.8.0.2
>

Actions: View | Diff

Attachments on bug 894626: 677460 | 678262 | 680418