- fix bug #444: setusercontext was called too late (thanks Bjorn

  Ketelaars).

git-svn-id: file:///svn/unbound/trunk@2657 be551aaa-1e26-0410-a405-d3ace91eadb9

diff --git a/daemon/unbound.c b/daemon/unbound.c
index 685277d5d2ffbcdf55ac2dc2566bbb167ffedd8f..6d87a4f6d5c4ace99b2850f82f293edb4ba98a16 100644 (file)
--- a/daemon/unbound.c
+++ b/daemon/unbound.c
@@ -502,6 +502,21 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
        (void)daemon;
 #endif
 
+       /* Set user context */
+#ifdef HAVE_GETPWNAM
+       if(cfg->username && cfg->username[0]) {
+#ifdef HAVE_SETUSERCONTEXT
+               /* setusercontext does initgroups, setuid, setgid, and
+                * also resource limits from login config, but we
+                * still call setresuid, setresgid to be sure to set all uid*/
+               if(setusercontext(NULL, pwd, uid,
+                       LOGIN_SETALL & ~LOGIN_SETUSER & ~LOGIN_SETGROUP) != 0)
+                       log_warn("unable to setusercontext %s: %s",
+                               cfg->username, strerror(errno));
+#endif /* HAVE_SETUSERCONTEXT */
+       }
+#endif /* HAVE_GETPWNAM */
+
        /* box into the chroot */
 #ifdef HAVE_CHROOT
        if(cfg->chrootdir && cfg->chrootdir[0]) {
@@ -554,20 +569,11 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
        /* drop permissions after chroot, getpwnam, pidfile, syslog done*/
 #ifdef HAVE_GETPWNAM
        if(cfg->username && cfg->username[0]) {
-#ifdef HAVE_SETUSERCONTEXT
-               /* setusercontext does initgroups, setuid, setgid, and
-                * also resource limits from login config, but we
-                * still call setresuid, setresgid to be sure to set all uid*/
-               if(setusercontext(NULL, pwd, uid, LOGIN_SETALL) != 0)
-                       log_warn("unable to setusercontext %s: %s",
-                               cfg->username, strerror(errno));
-#else /* !HAVE_SETUSERCONTEXT */
 #  ifdef HAVE_INITGROUPS
                if(initgroups(cfg->username, gid) != 0)
                        log_warn("unable to initgroups %s: %s",
                                cfg->username, strerror(errno));
 #  endif /* HAVE_INITGROUPS */
-#endif /* HAVE_SETUSERCONTEXT */
                endpwent();
 
 #ifdef HAVE_SETRESGID

diff --git a/doc/Changelog b/doc/Changelog
index 6ef467f459e24a0e7838b8fe72d458a8fb916433..56798cca40511e6ac0caba6bb760cbe9e9bdd401 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,5 +1,7 @@
 5 April 2012: Wouter
        - fix bug #443: --with-chroot-dir not honoured by configure.
+       - fix bug #444: setusercontext was called too late (thanks Bjorn
+         Ketelaars).
 
 27 March 2012: Wouter
        - fix bug #442: Fix that Makefile depends on pythonmod headers