nspawn: reset supplementary and main group id before entering nspawn

diff --git a/TODO b/TODO
index 4a49f493695477ab9c8f3808514f755f4e019112..85b6e9bb525b4095dab26001594087b0bf1d4ea3 100644 (file)
--- a/TODO
+++ b/TODO
@@ -180,8 +180,6 @@ Features:
 
 * nspawn: implement personality changes a la linux32(8)
 
 
 * nspawn: implement personality changes a la linux32(8)
 

-* nspawn: reset all aux groups
-

 * cryptsetup-generator: warn if the password files are world-readable
 
 * cryptsetup-generator: add RequiresMountsFor= to cryptseup service files referencing a file, similar for devices
 * cryptsetup-generator: warn if the password files are world-readable
 
 * cryptsetup-generator: add RequiresMountsFor= to cryptseup service files referencing a file, similar for devices

diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
index 244ebb83425faa00010c2cb104fe80c965284ca1..59171abff3cdb6c2e14ffbf50d9fb372baed362e 100644 (file)
--- a/src/nspawn/nspawn.c
+++ b/src/nspawn/nspawn.c
@@ -1327,6 +1327,23 @@ int main(int argc, char *argv[]) {
                                         log_error("setreuid() failed: %m");
                                         goto child_fail;
                                 }
                                         log_error("setreuid() failed: %m");
                                         goto child_fail;
                                 }

+                        } else {
+                                /* Reset everything fully to 0, just in case */
+
+                                if (setgroups(0, NULL) < 0) {
+                                        log_error("setgroups() failed: %m");
+                                        goto child_fail;
+                                }
+
+                                if (setresgid(0, 0, 0) < 0) {
+                                        log_error("setregid() failed: %m");
+                                        goto child_fail;
+                                }
+
+                                if (setresuid(0, 0, 0) < 0) {
+                                        log_error("setreuid() failed: %m");
+                                        goto child_fail;
+                                }

                         }
 
                         if ((asprintf((char**)(envp + 3), "HOME=%s", home ? home: "/root") < 0) ||
                         }
 
                         if ((asprintf((char**)(envp + 3), "HOME=%s", home ? home: "/root") < 0) ||