dcp: call setgroups before setuid (#569)

When giving up privileges, setgroups should be called before setuid and/or setgid to avoid permission leaks. Resolves #567 Signed-off-by: Dalton Bohning <[email protected]>
hpc · Apr 11, 2024 · 3e970d8 · 3e970d8
1 parent 9acb07a
commit 3e970d8
Showing 1 changed file with 10 additions and 0 deletions.
diff --git a/src/dcp/dcp.c b/src/dcp/dcp.c
@@ -395,6 +395,16 @@ int main(int argc, char** argv)
         return 1;
     }
 
+    /* setgroups before set gid or uid */
+    if (gid > 0 || uid > 0) {
+        if (setgroups(0, NULL) < 0) {
+            MFU_LOG(MFU_LOG_ERR, "Could not setgroups: %s", strerror(errno));
+            mfu_finalize();
+            MPI_Finalize();
+            return 1;
+        }
+    }
+
     /* set egid */
     if (gid > 0) {
         if (setegid(gid) < 0) {