Call initgroups before setuid #148
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
This was originally reported at ndmitchell/ghcid#261. |
|
I'm surprised that appveyor is failing on this. I'll try rebasing on |
snoyberg
requested changes
Jul 4, 2019
|
I have tested Ben's patch with ghc-8.6.5, |
The error message lookup logic would fallthrough from the forkSetuidFailed case into the default case, meaning that the error message of the former would never be returned.
bgamari
force-pushed
the
initgroups
branch
2 times, most recently
from
d70c604
to
3e0812f
Compare
|
Seems to build okay on Windows now 👍 |
snoyberg
approved these changes
Jul 19, 2019
snoyberg
requested changes
Jul 19, 2019
Previously we would fail to call initgroups before setuid'ing. This meant that our groups we not be reset to reflect those our new user belongs to. Fix this.
|
@snoyberg, done. |
snoyberg
approved these changes
Jul 21, 2019
liuyangxy
pushed a commit
to fedora-riscv/ghc
that referenced
this pull request
Apr 19, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This fixes a potential privilege escalation issue (or, more precisely, privileges not being dropped when this was the user's intent) where the groups of the spawning process's user would be incorrectly retained due to a missing call to
initgroups.This also fixes an incorrect case fallthrough in the error message lookup logic.
Fixes #149.