From 03ab0104abd18f1d137eac9a02a18fafeacd736c Mon Sep 17 00:00:00 2001 From: Steve Grubb Date: Mon, 1 Aug 2011 14:28:27 -0400 Subject: [PATCH] capng: Drop supplemental groups when switching to daemon user This patch ensures the daemon process doesn't inherit any supplemental groups for the root user from an administrator login via an init script. This is only an issue for pre-systemd systems. https://bugzilla.redhat.com/show_bug.cgi?id=726953 --- bus/selinux.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bus/selinux.c b/bus/selinux.c index e94d8a8..36287e9 100644 --- a/bus/selinux.c +++ b/bus/selinux.c @@ -1055,7 +1055,7 @@ _dbus_change_to_daemon_user (const char *user, capng_clear (CAPNG_SELECT_BOTH); capng_update (CAPNG_ADD, CAPNG_EFFECTIVE | CAPNG_PERMITTED, CAP_AUDIT_WRITE); - rc = capng_change_id (uid, gid, 0); + rc = capng_change_id (uid, gid, CAPNG_DROP_SUPP_GRP); if (rc) { switch (rc) { -- 2.7.4