-
Notifications
You must be signed in to change notification settings - Fork 398
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Implement dropping group privileges #239
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Code looks good, but I'm not sure I see a strong use case. The only case I can think of is when proxying the unix sockets which are restricted to specific groups. Did you have another use case in mind, or was this just for completeness?
src/sniproxy.c
Outdated
@@ -222,11 +222,25 @@ drop_perms(const char *username) { | |||
else if (user == NULL) | |||
fatal("getpwnam(): user %s does not exist", username); | |||
|
|||
gid_t gid = user->pw_gid; | |||
|
|||
if (groupname) { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Can we explicitly check groupname != NULL
?
This is both for completeness and the fact that it complements #224. We have some files that are mode 0540 so sniproxy needs to run as the group writing those files. Having a group command is easier than letting the package create the user+group and then moving the user to a different primary group 😄 |
188b602
to
a598db4
Compare
I just noticed the is a memory leak if the configuration contains duplicate username and groupname directives. Running
I'll add necessary checks to this |
This PR adds support for running sniproxy as a different group than the primary group set with the
user
configuration option. Agroup
option can now be used in the config-file.If no group is provided, the user's default group is used.