netdata now sets the supplementary groups of its user #115
Costa Tsaousis (ktsaou) committed
Apr 27, 2016 at 11:14 UTC
577103e7d293397bfe7de7c23d792c6f340a10b5
1 file changed
+25
src/daemon.c
+25
@@ -10,6 +10,7 @@
10
#include <string.h>
11
#include <sys/types.h>
12
#include <pwd.h>
13
+#include <grp.h>
14
#include <pthread.h>
15
#include <sys/wait.h>
16
#include <sys/stat.h>
@@ -85,6 +86,21 @@ int become_user(const char *username)
86
uid_t uid = pw->pw_uid;
87
gid_t gid = pw->pw_gid;
88
89
+ int ngroups = sysconf(_SC_NGROUPS_MAX);
90
+ gid_t *supplementary_groups = NULL;
91
+ if(ngroups) {
92
+ supplementary_groups = malloc(sizeof(gid_t) * ngroups);
93
+ if(supplementary_groups) {
94
+ if(getgrouplist(username, gid, supplementary_groups, &ngroups) == -1) {
95
+ error("Cannot get supplementary groups of user '%s'.", username);
96
+ free(supplementary_groups);
97
+ supplementary_groups = NULL;
98
+ ngroups = 0;
99
+ }
100
+ }
101
+ else fatal("Cannot allocate memory for %d supplementary groups", ngroups);
102
+ }
103
+
104
if(pidfile[0] && getuid() != uid) {
105
// we are dropping privileges
106
if(chown(pidfile, uid, gid) != 0)
@@ -102,6 +118,15 @@ int become_user(const char *username)
118
pidfd = -1;
119
}
120
121
+ if(supplementary_groups && ngroups) {
122
+ if(setgroups(ngroups, supplementary_groups) == -1)
123
+ error("Cannot set supplementary groups for user '%s'", username);
124
+
125
+ free(supplementary_groups);
126
+ supplementary_groups = NULL;
127
+ ngroups = 0;
128
+ }
129
+
130
if(setresgid(gid, gid, gid) != 0) {
131
error("Cannot switch to user's %s group (gid: %d).", username, gid);
132
return -1;