capng: Drop supplemental groups when switching to daemon user

[platform/upstream/dbus.git] / bus / selinux.c

diff --git a/bus/selinux.c b/bus/selinux.c
index e94d8a8..36287e9 100644 (file)
--- a/bus/selinux.c
+++ b/bus/selinux.c
@@ -1055,7 +1055,7 @@ _dbus_change_to_daemon_user  (const char    *user,
       capng_clear (CAPNG_SELECT_BOTH);
       capng_update (CAPNG_ADD, CAPNG_EFFECTIVE | CAPNG_PERMITTED,
                     CAP_AUDIT_WRITE);
-      rc = capng_change_id (uid, gid, 0);
+      rc = capng_change_id (uid, gid, CAPNG_DROP_SUPP_GRP);
       if (rc)
         {
           switch (rc) {