Bug 1000722

ngircd do not drop supplementary groups when run, which mean it is still running with partially elevated privileges.

Using the default config :

# ngircd -n
[12357:4    0] Can't read MOTD file "/etc/ngircd.motd": No such file or directory
[12357:4    0] No administrative information configured but required by RFC!
[12357:5    0] ngIRCd 20.2-IDENT+IPv6+IRCPLUS+SSL+SYSLOG+TCPWRAP+ZLIB-x86_64/redhat/linux-gnu started.
[12357:6    0] Using configuration file "/etc/ngircd.conf" ...
[12357:6    0] Running as user ngircd(468), group ngircd(452), with PID 12357.
[12357:6    0] Not running with changed root directory.
[12357:6    0] IO subsystem: epoll (hint size 100, initial maxfd 100, masterfd 3).
[12357:6    0] Now listening on [127.0.0.1]:6667 (socket 6).

On another terminal

$ grep Group /proc/12357/status
Groups:	0 1 2 3 4 6 10 

that's root, bin, daemon, sys, adm, disk and wheel. The last one is IMHO quite problematic.

Indeed, looking at the code, it fail to call initgrp to make sure the supplementary group are dropped. 

This is not a issue on systemd since it start with a empty environment, but is a issue on RHEL 6 ( likely for EPEL ).

I didn't notify upstream yet, nor asked for a CVE, and do not have a patch ready now, but I will be working on a patch if time permit. Following what was done on https://bugzilla.redhat.com/show_bug.cgi?id=894626 , I marked it as a security issue.