capng: Drop supplemental groups when switching to daemon user

[platform/upstream/dbus.git] / bus / selinux.c

diff --git a/bus/selinux.c b/bus/selinux.c
index c4b33d6..36287e9 100644 (file)
--- a/bus/selinux.c
+++ b/bus/selinux.c
@@ -20,6 +20,8 @@
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
  *
  */
+
+#include <config.h>
 #include <dbus/dbus-internals.h>
 #include <dbus/dbus-string.h>
 #ifndef DBUS_WIN
@@ -162,7 +164,7 @@ log_callback (const char *fmt, ...)
   }
 #endif /* HAVE_LIBAUDIT */
   
-  vsyslog (LOG_INFO, fmt, ap);
+  vsyslog (LOG_USER | LOG_INFO, fmt, ap);
   va_end(ap);
 }
 
@@ -340,7 +342,6 @@ bus_selinux_full_init (void)
     }
   else
     {
-      openlog ("dbus", LOG_PERROR, LOG_USER);
       _dbus_verbose ("Access Vector Cache (AVC) started.\n");
     }
 
@@ -1054,7 +1055,7 @@ _dbus_change_to_daemon_user  (const char    *user,
       capng_clear (CAPNG_SELECT_BOTH);
       capng_update (CAPNG_ADD, CAPNG_EFFECTIVE | CAPNG_PERMITTED,
                     CAP_AUDIT_WRITE);
-      rc = capng_change_id (uid, gid, 0);
+      rc = capng_change_id (uid, gid, CAPNG_DROP_SUPP_GRP);
       if (rc)
         {
           switch (rc) {