redsocks icon indicating copy to clipboard operation
redsocks copied to clipboard

Check return setgroups result for safety

Open theopolis opened this issue 6 years ago • 0 comments

Hi, I was reviewing the privilege dropping code and saw that the return from setgroups is not checked. https://github.com/darkk/redsocks/blob/c3fc945d1f33733e94a485f48a0b963979642b78/base.c#L399

If this call fails then supplemental groups may not be dropped as intended and this may have security impact. Additionally it might be better to swap setgroups with initgroups for the target user. This makes sure the process gains potentially restrictive groups. In either case if the result is non-0 then the program should fail.

theopolis avatar Feb 08 '20 19:02 theopolis