From 3c957acf86b9ec482a527528987b2462a32e0d07 Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Wed, 21 Nov 2012 02:58:55 +0100
Subject: [PATCH] nspawn: reset supplementary and main group id before entering
nspawn
---
TODO | 2 --
src/nspawn/nspawn.c | 17 +++++++++++++++++
2 files changed, 17 insertions(+), 2 deletions(-)
diff --git a/TODO b/TODO
index 4a49f493695..85b6e9bb525 100644
--- a/TODO
+++ b/TODO
@@ -180,8 +180,6 @@ Features:
* nspawn: implement personality changes a la linux32(8)
-* nspawn: reset all aux groups
-
* cryptsetup-generator: warn if the password files are world-readable
* cryptsetup-generator: add RequiresMountsFor= to cryptseup service files referencing a file, similar for devices
diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
index 244ebb83425..59171abff3c 100644
--- a/src/nspawn/nspawn.c
+++ b/src/nspawn/nspawn.c
@@ -1327,6 +1327,23 @@ int main(int argc, char *argv[]) {
log_error("setreuid() failed: %m");
goto child_fail;
}
+ } else {
+ /* Reset everything fully to 0, just in case */
+
+ if (setgroups(0, NULL) < 0) {
+ log_error("setgroups() failed: %m");
+ goto child_fail;
+ }
+
+ if (setresgid(0, 0, 0) < 0) {
+ log_error("setregid() failed: %m");
+ goto child_fail;
+ }
+
+ if (setresuid(0, 0, 0) < 0) {
+ log_error("setreuid() failed: %m");
+ goto child_fail;
+ }
}
if ((asprintf((char**)(envp + 3), "HOME=%s", home ? home: "/root") < 0) ||