diff -durN inn-2.4.0.orig/expire/expire.c inn-2.4.0/expire/expire.c --- inn-2.4.0.orig/expire/expire.c Fri May 9 06:25:27 2003 +++ inn-2.4.0/expire/expire.c Fri Dec 5 09:50:12 2003 @@ -8,6 +8,7 @@ #include #include #include +#include #include #include #include @@ -496,12 +497,19 @@ setuid_news(void) { struct passwd *pwd; + struct group *grp; pwd = getpwnam(NEWSUSER); if (pwd == NULL) die("can't resolve %s to a UID (account doesn't exist?)", NEWSUSER); - if (getuid() == 0) + grp = getgrnam(NEWSGRP); + if (grp == NULL) + die("can't resolve %s to a GID (account doesn't exist?)", NEWSGRP); + if (getuid() == 0) { + setgid(grp->gr_gid); + initgroups(pwd->pw_name,grp->gr_gid); setuid(pwd->pw_uid); + } if (getuid() != pwd->pw_uid) die("must be run as %s", NEWSUSER); } diff -durN inn-2.4.0.orig/expire/expireover.c inn-2.4.0/expire/expireover.c --- inn-2.4.0.orig/expire/expireover.c Fri May 9 06:25:27 2003 +++ inn-2.4.0/expire/expireover.c Fri Dec 5 09:50:22 2003 @@ -12,6 +12,7 @@ #include "clibrary.h" #include #include +#include #include #include @@ -53,12 +54,19 @@ setuid_news(void) { struct passwd *pwd; + struct group *grp; pwd = getpwnam(NEWSUSER); if (pwd == NULL) die("can't resolve %s to a UID (account doesn't exist?)", NEWSUSER); - if (getuid() == 0) + grp = getgrnam(NEWSGRP); + if (grp == NULL) + die("can't resolve %s to a GID (account doesn't exist?)", NEWSGRP); + if (getuid() == 0) { + setgid(grp->gr_gid); + initgroups(pwd->pw_name,grp->gr_gid); setuid(pwd->pw_uid); + } if (getuid() != pwd->pw_uid) die("must be run as %s", NEWSUSER); } diff -durN inn-2.4.0.orig/expire/makedbz.c inn-2.4.0/expire/makedbz.c --- inn-2.4.0.orig/expire/makedbz.c Fri May 9 06:25:27 2003 +++ inn-2.4.0/expire/makedbz.c Fri Dec 5 09:50:35 2003 @@ -7,6 +7,7 @@ #include "clibrary.h" #include #include +#include #include #include "dbz.h" @@ -238,17 +239,23 @@ setuid_news(void) { struct passwd *pwd; + struct group *grp; pwd = getpwnam(NEWSUSER); if (pwd == NULL) die("can't resolve %s to a UID (account doesn't exist?)", NEWSUSER); - if (getuid() == 0) + grp = getgrnam(NEWSGRP); + if (grp == NULL) + die("can't resolve %s to a GID (account doesn't exist?)", NEWSGRP); + if (getuid() == 0) { + setgid(grp->gr_gid); + initgroups(pwd->pw_name,grp->gr_gid); setuid(pwd->pw_uid); + } if (getuid() != pwd->pw_uid) die("must be run as %s", NEWSUSER); } - int main(int argc, char **argv) { diff -durN inn-2.4.0.orig/expire/makehistory.c inn-2.4.0/expire/makehistory.c --- inn-2.4.0.orig/expire/makehistory.c Fri May 9 06:25:27 2003 +++ inn-2.4.0/expire/makehistory.c Fri Dec 5 09:50:52 2003 @@ -9,6 +9,7 @@ #include #include #include +#include #include #include "inn/buffer.h" @@ -714,17 +715,23 @@ setuid_news(void) { struct passwd *pwd; + struct group *grp; pwd = getpwnam(NEWSUSER); if (pwd == NULL) die("can't resolve %s to a UID (account doesn't exist?)", NEWSUSER); - if (getuid() == 0) + grp = getgrnam(NEWSGRP); + if (grp == NULL) + die("can't resolve %s to a GID (account doesn't exist?)", NEWSGRP); + if (getuid() == 0) { + setgid(grp->gr_gid); + initgroups(pwd->pw_name,grp->gr_gid); setuid(pwd->pw_uid); + } if (getuid() != pwd->pw_uid) die("must be run as %s", NEWSUSER); } - int main(int argc, char **argv) { diff -durN inn-2.4.0.orig/innd/inndstart.c inn-2.4.0/innd/inndstart.c --- inn-2.4.0.orig/innd/inndstart.c Fri May 9 06:25:27 2003 +++ inn-2.4.0/innd/inndstart.c Fri Dec 5 09:49:45 2003 @@ -308,6 +308,7 @@ /* Now, permanently drop privileges. */ if (setgid(news_gid) < 0 || getgid() != news_gid) sysdie("can't setgid to %lu", (unsigned long)news_gid); + initgroups(NEWSUSER,news_gid); if (setuid(news_uid) < 0 || getuid() != news_uid) sysdie("can't setuid to %lu", (unsigned long)news_uid); diff -durN inn-2.4.0.orig/innfeed/startinnfeed.c inn-2.4.0/innfeed/startinnfeed.c --- inn-2.4.0.orig/innfeed/startinnfeed.c Fri May 9 06:25:27 2003 +++ inn-2.4.0/innfeed/startinnfeed.c Fri Dec 5 09:49:45 2003 @@ -97,6 +97,9 @@ #endif /* HAVE_SETRLIMIT */ /* Permanently drop privileges. */ + if (setgid(news_gid) < 0 || getgid() != news_gid) + sysdie("can't setgid to %lu", (unsigned long) news_gid); + initgroups(NEWSUSER,news_gid); if (setuid(news_uid) < 0 || getuid() != news_uid) sysdie("can't setuid to %lu", (unsigned long) news_uid);