qbit/xenocara
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Don't try to revoque privileges if priv_init is called without

Browse Source 
privileges. The parent process will be used for operations
that can't be pledged.
This commit is contained in:
matthieu 2015-11-14 17:12:14 +00:00
parent d98e5b49b4
commit 5092a69bf9
1 changed files with 10 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
app/xconsole/privsep.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: privsep.c,v 1.6 2015/11/11 21:20:12 matthieu Exp $ */
/* $OpenBSD: privsep.c,v 1.7 2015/11/14 17:12:14 matthieu Exp $ */
/*
* Copyright 2001 Niels Provos <provos@citi.umich.edu>
* All rights reserved.
@ -165,13 +165,15 @@ priv_init(uid_t uid, gid_t gid)
}
if (pid != 0) {
/* Father - drop privileges and return */
if (setgroups(1, &gid) == -1)
return -1;
if (uid != -1 && gid != -1) {
if (setgroups(1, &gid) == -1)
return -1;
if (setresgid(gid, gid, gid) == -1)
return -1;
if (setresuid(uid, uid, uid) == -1)
return -1;
if (setresgid(gid, gid, gid) == -1)
return -1;
if (setresuid(uid, uid, uid) == -1)
return -1;
}
close(socks[0]);
priv_fd = socks[1];
return 0;