[Bug 812] ntpd should drop supplementary groups

bk: 46299dbdLtk4lwQNbmEFLHH2xYWeog

diff --git a/ntpd/ntpd.c b/ntpd/ntpd.c
index 5248c1bf2efa6b57307366069cc0b83a0cfd09e1..9a8eed57b205de7ab3cc4b7c51e3bdf0e57fb823 100644 (file)
--- a/ntpd/ntpd.c
+++ b/ntpd/ntpd.c
@@ -874,13 +874,31 @@ ntpdmain(
                                sw_uid = (uid_t)strtoul(user, &endp, 0);
                                if (*endp != '\0') 
                                        goto getuser;
+
+                               if ((pw = getpwuid(sw_uid)) != NULL) {
+                                       user = strdup(pw->pw_name);
+                                       if (NULL == user) {
+                                               msyslog(LOG_ERR, "strdup() failed: %m");
+                                               exit (-1);
+                                       }
+                                       sw_gid = pw->pw_gid;
+                               } else {
+                                       errno = 0;
+                                       msyslog(LOG_ERR, "Cannot find user ID %s", user);
+                                       exit (-1);
+                               }
+
                        } else {
 getuser:       
+                               errno = 0;
                                if ((pw = getpwnam(user)) != NULL) {
                                        sw_uid = pw->pw_uid;
+                                       sw_gid = pw->pw_gid;
                                } else {
-                                       errno = 0;
-                                       msyslog(LOG_ERR, "Cannot find user `%s'", user);
+                                       if (errno)
+                                           msyslog(LOG_ERR, "getpwnam(%s) failed: %m", user);
+                                       else
+                                           msyslog(LOG_ERR, "Cannot find user `%s'", user);
                                        exit (-1);
                                }
                        }
@@ -913,6 +931,10 @@ getgroup:
                                exit (-1);
                        }
                }
+               if (user && initgroups(user, sw_gid)) {
+                       msyslog(LOG_ERR, "Cannot initgroups() to user `%s': %m", user);
+                       exit (-1);
+               }
                if (group && setgid(sw_gid)) {
                        msyslog(LOG_ERR, "Cannot setgid() to group `%s': %m", group);
                        exit (-1);