forked from pool/lua-luaposix
Matěj Cepl
600f3b4e23
Also, add setgroups.patch to avoid security issue with not calling setgroups() before setuid() (gh#luaposix/luaposix!388).
28 lines
892 B
Diff
28 lines
892 B
Diff
---
|
|
ext/posix/unistd.c | 8 ++++++++
|
|
1 file changed, 8 insertions(+)
|
|
|
|
Index: luaposix-35.1/ext/posix/unistd.c
|
|
===================================================================
|
|
--- luaposix-35.1.orig/ext/posix/unistd.c 2021-09-10 02:42:44.000000000 +0200
|
|
+++ luaposix-35.1/ext/posix/unistd.c 2025-10-13 12:57:47.759515415 +0200
|
|
@@ -1063,10 +1063,18 @@
|
|
case 'U':
|
|
return pushresult(L, seteuid(mygetuid(L, 2)), NULL);
|
|
case 'u':
|
|
+#if HAVE_SETGROUPS
|
|
+ if (setgroups(0, NULL) == -1)
|
|
+ return pusherror(L, "setgroups");
|
|
+#endif
|
|
return pushresult(L, setuid(mygetuid(L, 2)), NULL);
|
|
case 'G':
|
|
return pushresult(L, setegid(mygetgid(L, 2)), NULL);
|
|
case 'g':
|
|
+#if HAVE_SETGROUPS
|
|
+ if (setgroups(0, NULL) == -1)
|
|
+ return pusherror(L, "setgroups");
|
|
+#endif
|
|
return pushresult(L, setgid(mygetgid(L, 2)), NULL);
|
|
case 's':
|
|
return pushresult(L, setsid(), NULL);
|