Don't change effective uid when we already dropped privileges

When running on Linux and system capabilities are available, named will
drop the extra capabilities before loading the configuration.  This led
to spurious warnings from `seteuid()` because named already dropped
CAP_SETUID and CAP_GETUID capabilities.

The fix removes setting the effective uid/gid when capabilities are
available, and adds a check that we are running under the user we were
requested to run.

(cherry picked from commit 6c82e2af92c741b52585e67054a67862211875b0)

diff --git a/bin/named/unix/os.c b/bin/named/unix/os.c
index 809cede37546f820761ab580b2ff59086a0f491c..150492ffc9a003fa05c65b53065174e64ae595c7 100644 (file)
--- a/bin/named/unix/os.c
+++ b/bin/named/unix/os.c
@@ -42,6 +42,7 @@
 #include <isc/result.h>
 #include <isc/strerror.h>
 #include <isc/string.h>
+#include <isc/util.h>
 
 #include <named/globals.h>
 #include <named/main.h>
@@ -786,6 +787,7 @@ mkdirpath(char *filename, void (*report)(const char *, ...)) {
        return (-1);
 }
 
+#ifndef HAVE_LINUXTHREADS
 static void
 setperms(uid_t uid, gid_t gid) {
 #if defined(HAVE_SETEGID) || defined(HAVE_SETRESGID)
@@ -829,6 +831,7 @@ setperms(uid_t uid, gid_t gid) {
        }
 #endif
 }
+#endif /* !HAVE_LINUXTHREADS */
 
 FILE *
 ns_os_openfile(const char *filename, mode_t mode, bool switch_user) {
@@ -853,17 +856,20 @@ ns_os_openfile(const char *filename, mode_t mode, bool switch_user) {
        free(f);
 
        if (switch_user && runas_pw != NULL) {
-#ifndef HAVE_LINUXTHREADS
+               uid_t olduid = getuid();
                gid_t oldgid = getgid();
-#endif
+#ifdef HAVE_LINUXTHREADS
+               REQUIRE(olduid == runas_pw->pw_uid);
+               REQUIRE(oldgid == runas_pw->pw_gid);
+#else
                /* Set UID/GID to the one we'll be running with eventually */
                setperms(runas_pw->pw_uid, runas_pw->pw_gid);
-
+#endif
                fd = safe_open(filename, mode, false);
 
 #ifndef HAVE_LINUXTHREADS
                /* Restore UID/GID to root */
-               setperms(0, oldgid);
+               setperms(olduid, oldgid);
 #endif /* HAVE_LINUXTHREADS */
 
                if (fd == -1) {