ngircd: discard supplementary group ids on startup

The intention was to switch to JUST uid:gid, but setgid is not
sufficient.

Reported-by:  Michael Scherer <misc@zarb.org>

diff --git a/src/ngircd/ngircd.c b/src/ngircd/ngircd.c
index e075e0a7355486c826497bd602cd64be7b1990ab..4099719b8ebe703e66960c97ae999df1f3274043 100644 (file)
--- a/src/ngircd/ngircd.c
+++ b/src/ngircd/ngircd.c
@@ -724,6 +724,11 @@ NGIRCd_Init(bool NGIRCd_NoDaemon)
                        if (real_errno != EPERM) 
                                goto out;
                }
+               if (setgroups(0, NULL) != 0) {
+                       Log(LOG_ERR, "Can't drop supplementary group ids: %s!",
+                                       strerror(errno));
+                       goto out;
+               }
        }
 #endif