Oops -- have to call setgroups() before giving up root.

Doc some of the peculiarities about starting rsyncd as root vs
non-root.

diff --git a/clientserver.c b/clientserver.c
index 6f3edfa..1cbabd3 100644 (file)
--- a/clientserver.c
+++ b/clientserver.c
@@ -282,6 +282,26 @@ static int rsync_module(int fd, int i)
        }
 
        if (am_root) {
+#ifdef HAVE_SETGROUPS
+               /* Get rid of any supplementary groups this process
+                * might have inheristed. */
+               if (setgroups(0, NULL)) {
+                       rsyserr(FERROR, errno, "setgroups failed");
+                       io_printf(fd, "@ERROR: setgroups failed\n");
+                       return -1;
+               }
+#endif
+
+               /* XXXX: You could argue that if the daemon is started
+                * by a non-root user and they explicitly specify a
+                * gid, then we should try to change to that gid --
+                * this could be possible if it's already in their
+                * supplementary groups. */
+
+               /* TODO: Perhaps we need to document that if rsyncd is
+                * started by somebody other than root it will inherit
+                * all their supplementary groups. */
+
                if (setgid(gid)) {
                        rsyserr(FERROR, errno, "setgid %d failed", (int) gid);
                        io_printf(fd,"@ERROR: setgid failed\n");
@@ -294,16 +314,6 @@ static int rsync_module(int fd, int i)
                        return -1;
                }
 
-#ifdef HAVE_SETGROUPS
-               /* Get rid of any supplementary groups this process
-                * might have inheristed. */
-               if (setgroups(0, NULL)) {
-                       rsyserr(FERROR, errno, "setgroups failed");
-                       io_printf(fd, "@ERROR: setgroups failed\n");
-                       return -1;
-               }
-#endif
-
                am_root = (getuid() == 0);
        }