Skip to content

Commit a0d49dd

Browse files
jvgutierrezezelkow1
authored andcommitted
Invoke initgroups() iff we got enough privileges (#11869) (#11872)
Follow up of #11855, that rendered unusable ATS as root when spawned via traffic_manager. (cherry picked from commit d4dda9b)
1 parent de3e587 commit a0d49dd

File tree

1 file changed

+4
-2
lines changed

1 file changed

+4
-2
lines changed

src/tscore/ink_cap.cc

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -160,8 +160,10 @@ impersonate(const struct passwd *pwd, ImpersonationLevel level)
160160
#endif
161161

162162
// Always repopulate the supplementary group list for the new user.
163-
if (initgroups(pwd->pw_name, pwd->pw_gid) != 0) {
164-
Fatal("switching to user %s, failed to initialize supplementary groups ID %ld", pwd->pw_name, (long)pwd->pw_gid);
163+
if (geteuid() == 0) { // check that we have enough rights to call initgroups()
164+
if (initgroups(pwd->pw_name, pwd->pw_gid) != 0) {
165+
Fatal("switching to user %s, failed to initialize supplementary groups ID %ld", pwd->pw_name, (long)pwd->pw_gid);
166+
}
165167
}
166168

167169
switch (level) {

0 commit comments

Comments
 (0)