Explorar el Código

HUE-277. supervisor.py doesn't drop group privileges

Philip Zeyliger hace 15 años
padre
commit
a6db9895ee
Se han modificado 1 ficheros con 12 adiciones y 3 borrados
  1. 12 3
      desktop/core/src/desktop/supervisor.py

+ 12 - 3
desktop/core/src/desktop/supervisor.py

@@ -32,6 +32,7 @@ This entry point should point to a SuperviseeSpec instance in your module.
 from daemon.pidlockfile import PIDLockFile
 import daemon
 import exceptions
+import grp
 import logging
 import optparse
 import os
@@ -61,9 +62,10 @@ LOG = logging.getLogger()
 TIME_WINDOW = 120
 MAX_RESTARTS_IN_WINDOW = 3
 
-# User to setuid down to for any supervisees that don't have the
-# drop_root option set to False
+# User and group to setuid/setgid down to for any supervisees that don't have
+# the drop_root option set to False
 SETUID_USER = "hue"
+SETGID_GROUP = "hue"
 
 # The entry point group in which to find processes to supervise.
 ENTRY_POINT_GROUP = "desktop.supervisor.specs"
@@ -259,8 +261,15 @@ def drop_privileges():
     print >>sys.stderr, "[ERROR] Couldn't get user information for user " + SETUID_USER
     raise
 
-  os.setuid(pw.pw_uid)
+  try:
+    gr = grp.getgrnam(SETGID_GROUP)
+  except:
+    print >>sys.stderr, "[ERROR] Couldn't get group information for group " + SETGID_GROUP
+    raise
 
+  # gid has to be set first
+  os.setgid(gr.gr_gid)
+  os.setuid(pw.pw_uid)
 
 def _init_log(log_dir):
   """Initialize logging configuration"""