[PATCH] Does not drop gid privileges

--==-=-=
Content-Type: multipart/mixed; boundary="=-=-="

--=-=-=
Content-Transfer-Encoding: quoted-printable

Hello,

perhaps I am missing something but what are the reasons that httpd.c
From=20fnord-1.10 does not drop the effective gid? It calls setgroups(2)
and setuid(2), but not setgid(2):

|     if (chdir("/")) goto error500;
|     if ((tmp=3Dgetenv("GID"))) {
|       long gid;
|       if (tmp[scan_ulong(tmp,&gid)]=3D=3D0) {
|         gid_t gi=3Dgid;
|         if (setgroups(1,&gi)) goto error500;
|       } else goto error500;
|     }
|     if ((tmp=3Dgetenv("UID"))) {
|       long uid;
|       if (tmp[scan_ulong(tmp,&uid)]=3D=3D0) {
|         if (setuid(uid)) goto error500;
|       } else goto error500;
|     }

I suggest to apply the attached patch; beside setgid(2), it calls
setgroups(2) with an empty list.



Enrico

--=-=-=
Content-Type: text/x-patch
Content-Disposition: attachment; filename=fnord-1.10-setgid.patch
Content-Description: drop group privileges

--- fnord-1.10/httpd.c.setgid	2005-08-03 13:32:50.000000000 +0200
+++ fnord-1.10/httpd.c	2005-12-27 04:37:43.000000000 +0100
@@ -1250,7 +1250,8 @@
       long gid;
       if (tmp[scan_ulong(tmp,&gid)]==0) {
 	gid_t gi=gid;
-	if (setgroups(1,&gi)) goto error500;
+	if (setgroups(0,0)) goto error500;
+	if (setgid(gi)) goto error500;
       } else goto error500;
     }
     if ((tmp=getenv("UID"))) {

--=-=-=--

--==-=-=
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iQEVAwUAQ7J0PjyfXseeoEz2AQrQ3wgAjHqFVsntRHtGTFQYlomuBkX5lGneMz1E
0kjajLwy58AwFAfOI7kHtnZ2k7W51OfHlQf2jUr0pRXe0GDQXarG3/+bNaVpi7co
xz7TamzdTclg0xg7JJtY4afxcvSPgB6wGLE+/ag14m0w1W5HxPkRVC7Z7f1wQw8j
YRNK0DONw0+7hVtxb7emfsWynGK2/ROdvf2jcG1XrcpfRvES6RJX6Eo7B5N3t5+l
bzZgl+bIUFSvXmayWnqoP9FyQE2ll56Ro8O+HcIA3xjuuxbAqZcgSG3WKusiTqTr
o2oxZ5ON3DBqExENGQRnNH79z3CeU74/3G1NimQ3syfQAYnfbKn2SA==
=8MNI
-----END PGP SIGNATURE-----
--==-=-=--