It used to be that xscreensaver discarded privs like this (simplified):
setgid (getgid());
setuid (getuid());
It was recently changed to this:
setgroups (1, &gid); /* the getgid() gid */
setgid (getgid());
setuid (getuid());
Without the call to setgroups(), the proces will retain any
supplementary gids associated with the uid, e.g.:
% groups root
root : root bin daemon sys adm disk wheel
So, there are really only two solutions to this:
1: Use a security framework that does not require any setuid/setgid
bits on the xscreensaver executable. For example, this is the
case with PAM on Red Hat, and with --with-passwd-helper mode on
SuSE.
2: Make the xscreensaver executable setuid root, so that it can
properly discard all its privs.
If you are getting this error, then I guess you did something like make
the executable be "setuid shadow", with the intent of making getpwnam()
work. But if you do only that, then the setgroups() call will fail, and
supplementary groups won't be discarded.
I suppose it might be possible to modify the code to not bother calling
setgroups() if the current getgroups() list already contains only one
group, our target; however, the call would still fail if there were any
other groups there.
--
Jamie Zawinski [EMAIL PROTECTED] http://www.jwz.org/
[EMAIL PROTECTED] http://www.dnalounge.com/
http://jwz.livejournal.com/
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
