Make sure we call setgroups() after setuid(). (Ethan Benson)

diff --git a/NEWS b/NEWS
index 8c54134..0d1fc6a 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,5 +1,10 @@
 rsync 2.5.3 (not released yet)
 
+  SECURITY FIXES:
+
+    * Make sure that supplementary groups are removed from a server
+      process after changing uid and gid. (Ethan Benson)
+
   ENHANCEMENTS:
 
     * Command to initiate connections is only shown with -vv, rather

diff --git a/clientserver.c b/clientserver.c
index 87e7990..6f3edfa 100644 (file)
--- a/clientserver.c
+++ b/clientserver.c
@@ -294,6 +294,16 @@ static int rsync_module(int fd, int i)
                        return -1;
                }
 
+#ifdef HAVE_SETGROUPS
+               /* Get rid of any supplementary groups this process
+                * might have inheristed. */
+               if (setgroups(0, NULL)) {
+                       rsyserr(FERROR, errno, "setgroups failed");
+                       io_printf(fd, "@ERROR: setgroups failed\n");
+                       return -1;
+               }
+#endif
+
                am_root = (getuid() == 0);
        }
 

diff --git a/configure.in b/configure.in
index 9456521..5eb0f77 100644 (file)
--- a/configure.in
+++ b/configure.in
@@ -351,7 +351,7 @@ AC_FUNC_UTIME_NULL
 AC_CHECK_FUNCS(waitpid wait4 getcwd strdup strerror chown chmod mknod)
 AC_CHECK_FUNCS(fchmod fstat strchr readlink link utime utimes strftime)
 AC_CHECK_FUNCS(memmove lchown vsnprintf snprintf asprintf setsid glob strpbrk)
-AC_CHECK_FUNCS(strlcat strlcpy mtrace mallinfo)
+AC_CHECK_FUNCS(strlcat strlcpy mtrace mallinfo setgroups)
 
 AC_CACHE_CHECK([for working socketpair],rsync_cv_HAVE_SOCKETPAIR,[
 AC_TRY_RUN([

diff --git a/log.c b/log.c
index f07b64b..532803f 100644 (file)
--- a/log.c
+++ b/log.c
@@ -342,6 +342,8 @@ void rsyserr(enum logcode code, int errcode, const char *format, ...)
        len = vsnprintf(buf, sizeof(buf), format, ap);
        va_end(ap);
 
+       /* TODO: Put in RSYNC_NAME at the start. */
+
        if ((size_t) len > sizeof(buf)-1)
                exit_cleanup(RERR_MESSAGEIO);