Drop sup groups BEFORE changing uid

@basepi, needs cherry-pick
saltstack · Oct 16, 2013 · 4c08bd5 · 4c08bd5
1 parent f06e04f
commit 4c08bd5
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/salt/utils/verify.py b/salt/utils/verify.py
@@ -289,13 +289,13 @@ def check_user(user):
     try:
         pwuser = pwd.getpwnam(user)
         try:
-            os.setgid(pwuser.pw_gid)
-            os.setuid(pwuser.pw_uid)
             if hasattr(os, 'initgroups'):
                 os.initgroups(user, pwuser.pw_gid)
             else:
                 os.setgroups([e.gr_gid for e in grp.getgrall()
                               if user in e.gr_mem] + [pwuser.gid])
+            os.setgid(pwuser.pw_gid)
+            os.setuid(pwuser.pw_uid)
 
         except OSError:
             msg = 'Salt configured to run as user "{0}" but unable to switch.'