diff options
author | 2018-04-11 17:33:10 -0400 | |
---|---|---|
committer | 2018-04-11 17:33:10 -0400 | |
commit | 5d6abb5abd847532ab27c423e988e360fa1c4abf (patch) | |
tree | 521f367e5d714efa74e68c699d1bd03f90d05d7a /src/firejail/util.c | |
parent | atool 'redirect' profiles (#1873) (diff) | |
download | firejail-5d6abb5abd847532ab27c423e988e360fa1c4abf.tar.gz firejail-5d6abb5abd847532ab27c423e988e360fa1c4abf.tar.zst firejail-5d6abb5abd847532ab27c423e988e360fa1c4abf.zip |
fix --join
Diffstat (limited to 'src/firejail/util.c')
-rw-r--r-- | src/firejail/util.c | 12 |
1 files changed, 10 insertions, 2 deletions
diff --git a/src/firejail/util.c b/src/firejail/util.c index 14e9f6440..3437d495f 100644 --- a/src/firejail/util.c +++ b/src/firejail/util.c | |||
@@ -37,7 +37,6 @@ static void clean_supplementary_groups(gid_t gid) { | |||
37 | assert(cfg.username); | 37 | assert(cfg.username); |
38 | gid_t groups[MAX_GROUPS]; | 38 | gid_t groups[MAX_GROUPS]; |
39 | int ngroups = MAX_GROUPS; | 39 | int ngroups = MAX_GROUPS; |
40 | |||
41 | int rv = getgrouplist(cfg.username, gid, groups, &ngroups); | 40 | int rv = getgrouplist(cfg.username, gid, groups, &ngroups); |
42 | if (rv == -1) | 41 | if (rv == -1) |
43 | goto clean_all; | 42 | goto clean_all; |
@@ -74,6 +73,13 @@ static void clean_supplementary_groups(gid_t gid) { | |||
74 | rv = setgroups(new_ngroups, new_groups); | 73 | rv = setgroups(new_ngroups, new_groups); |
75 | if (rv) | 74 | if (rv) |
76 | goto clean_all; | 75 | goto clean_all; |
76 | |||
77 | if (arg_debug) { | ||
78 | printf("Supplementary groups: "); | ||
79 | for (i = 0; i < new_ngroups; i++) | ||
80 | printf("%d ", new_groups[i]); | ||
81 | printf("\n"); | ||
82 | } | ||
77 | } | 83 | } |
78 | else | 84 | else |
79 | goto clean_all; | 85 | goto clean_all; |
@@ -92,13 +98,15 @@ clean_all: | |||
92 | void drop_privs(int nogroups) { | 98 | void drop_privs(int nogroups) { |
93 | EUID_ROOT(); | 99 | EUID_ROOT(); |
94 | gid_t gid = getgid(); | 100 | gid_t gid = getgid(); |
101 | if (arg_debug) | ||
102 | printf("Drop privileges: pid %d, uid %d, gid %d, nogroups %d\n", getpid(), getuid(), gid, nogroups); | ||
95 | 103 | ||
96 | // configure supplementary groups | 104 | // configure supplementary groups |
97 | if (gid == 0 || nogroups) { | 105 | if (gid == 0 || nogroups) { |
98 | if (setgroups(0, NULL) < 0) | 106 | if (setgroups(0, NULL) < 0) |
99 | errExit("setgroups"); | 107 | errExit("setgroups"); |
100 | if (arg_debug) | 108 | if (arg_debug) |
101 | printf("Username %s, no supplementary groups\n", cfg.username); | 109 | printf("No supplementary groups\n"); |
102 | } | 110 | } |
103 | else if (arg_noroot) | 111 | else if (arg_noroot) |
104 | clean_supplementary_groups(gid); | 112 | clean_supplementary_groups(gid); |