| commit | 558bfc4e1e629688fc78d16b18413ff9802dc8f4 | |
| author | Glenn Strauss <gstrauss@gluelogic.com> | |
| Sat, 30 Jul 2016 02:05:35 +0000 (29 22:05 -0400) | ||
| committer | Glenn Strauss <gstrauss@gluelogic.com> | |
| Sat, 30 Jul 2016 06:10:01 +0000 (30 02:10 -0400) | ||
| tree | 38361ec197c18e8a3d343ccac8633efd54dde840 | treesnapshot (tar.gz zip) |
| parent | f7410da5d2228cbf2d89524a6173f9fd2d0ff691 | commitdiff |
[security] ensure gid != 0 if server.username set (fixes #2725)
server.username can not be root or 0.
server.groupname can not be root or 0.
If server.username is set, previous behavior might retain gid 0
if server.groupname was not set.
New behavior calls setgid() on server.username primary gid, and
then initgroups on server.username if server.username is set but
server.groupname is not set.
x-ref:
"server.groupname not required with server.username"
https://redmine.lighttpd.net/issues/2725
server.username can not be root or 0.
server.groupname can not be root or 0.
If server.username is set, previous behavior might retain gid 0
if server.groupname was not set.
New behavior calls setgid() on server.username primary gid, and
then initgroups on server.username if server.username is set but
server.groupname is not set.
x-ref:
"server.groupname not required with server.username"
https://redmine.lighttpd.net/issues/2725
| src/server.c | diffblobblamehistory |