From 415b20b6fbf562d4132fca90a00b6c32d94040ed Mon Sep 17 00:00:00 2001 From: Orion Poplawski Date: Fri, 13 Feb 2015 13:32:17 +0100 Subject: Be compliant with POS36-C: Observe correct revocation order while relinquishing privileges (602_nx-X11_initgroups.full.patch). The Fedora review of NX (redistributed) caught the following rpmlint issue: This executable is calling setuid and setgid without setgroups or initgroups. There is a high probability this mean it didn't relinquish all groups, and this would be a potential security issue to be fixed. Seek POS36-C on the web for details about the problem. Ref POS36-C: https://www.securecoding.cert.org/confluence/display/seccode/POS36-C.+Observe+correct+revocation+order+while+relinquishing+privileges This patch adds initgroups() calls to the code to initialize the supplemental group list. --- nxcomp/Pipe.cpp | 3 +++ 1 file changed, 3 insertions(+) (limited to 'nxcomp') diff --git a/nxcomp/Pipe.cpp b/nxcomp/Pipe.cpp index 7238d0c73..aacbbaeb3 100644 --- a/nxcomp/Pipe.cpp +++ b/nxcomp/Pipe.cpp @@ -21,6 +21,7 @@ #include #include #include +#include #include "Pipe.h" #include "Misc.h" @@ -234,6 +235,8 @@ FILE *Popen(char * const parameters[], const char *type) // Child. // + struct passwd *pwent = getpwuid(getuid()); + if (pwent) initgroups(pwent->pw_name,getgid()); setgid(getgid()); setuid(getuid()); -- cgit v1.2.3