[cpp-sp COMMIT] in /branches/REL_2: configure.ac shibd/shibd.cpp

[noreply at shibboleth.net]

Author: scantor
Date: Wed Jul  1 20:43:27 2015
New Revision: 3921

URL: http://svn.shibboleth.net/view/cpp-sp?rev=3921&view=rev
Log:
SSPCPP-658 - setuid/setgid fails to remove supplementary groups

Modified:
    branches/REL_2/configure.ac
    branches/REL_2/shibd/shibd.cpp

Modified: branches/REL_2/configure.ac
URL: http://svn.shibboleth.net/view/cpp-sp/branches/REL_2/configure.ac?rev=3921&r1=3920&r2=3921&view=diff
==============================================================================
--- branches/REL_2/configure.ac	(original)
+++ branches/REL_2/configure.ac	Wed Jul  1 20:43:27 2015
@@ -77,7 +77,7 @@
 AC_FUNC_STRERROR_R
 AC_CHECK_HEADERS([sys/utsname.h grp.h pwd.h])
 AC_CHECK_HEADERS([sys/socket.h], [AC_DEFINE([SHIBSP_HAVE_SYS_SOCKET_H],[1],[Define to 1 if you have the <sys/socket> header file.])], [])
-AC_CHECK_FUNCS([strchr strdup strstr timegm gmtime_r localtime_r strtok_r strcasecmp getpwnam getgrnam])
+AC_CHECK_FUNCS([strchr strdup strstr timegm gmtime_r localtime_r strtok_r strcasecmp getpwnam getgrnam initgroups])
 AC_CHECK_TYPES([struct sockaddr_storage], [], [], [[#include <sys/socket.h>]])
 AC_CHECK_MEMBERS([struct sockaddr.sa_len], [], [], [[#include <sys/socket.h>]])
 

Modified: branches/REL_2/shibd/shibd.cpp
URL: http://svn.shibboleth.net/view/cpp-sp/branches/REL_2/shibd/shibd.cpp?rev=3921&r1=3920&r2=3921&view=diff
==============================================================================
--- branches/REL_2/shibd/shibd.cpp	(original)
+++ branches/REL_2/shibd/shibd.cpp	Wed Jul  1 20:43:27 2015
@@ -349,6 +349,13 @@
             fprintf(stderr, "getpwnam failed, check -u option\n");
             return -1;
         }
+#ifdef HAVE_INITGROUPS
+        // w/out initgroups/setgroups process retains supplementary groups
+        if (initgroups(pwd->pw_name, pwd->pw_gid) != 0) {
+            fprintf(stderr, "initgroups failed, check -u option\n");
+            return -1;
+        }
+#endif
         if (setuid(pwd->pw_uid) != 0) {
             fprintf(stderr, "setuid failed, check -u option\n");
             return -1;