Set group on sudo_debug when creating it to gid 0 so systems without

BSD group semantics don't get the invoking user's group.

diff --git a/common/sudo_debug.c b/common/sudo_debug.c
index 0c26cbd25e3020c5193d1f7dac089609c0e48af6..da90e8fef528f8a123ce882a395df2740a2bc4a5 100644 (file)
--- a/common/sudo_debug.c
+++ b/common/sudo_debug.c
@@ -138,10 +138,17 @@ int sudo_debug_init(const char *debugfile, const char *settings)
     if (debugfile != NULL) {
        if (sudo_debug_fd != -1)
            close(sudo_debug_fd);
-       sudo_debug_fd = open(debugfile, O_WRONLY|O_APPEND|O_CREAT,
-           S_IRUSR|S_IWUSR);
-       if (sudo_debug_fd == -1)
-           return 0;
+       sudo_debug_fd = open(debugfile, O_WRONLY|O_APPEND, S_IRUSR|S_IWUSR);
+       if (sudo_debug_fd == -1) {
+           /* Create debug file as needed and set group ownership. */
+           if (errno == ENOENT) {
+               sudo_debug_fd = open(debugfile, O_WRONLY|O_APPEND|O_CREAT,
+                   S_IRUSR|S_IWUSR);
+           }
+           if (sudo_debug_fd == -1)
+               return 0;
+           fchown(sudo_debug_fd, (uid_t)-1, 0);
+       }
        (void)fcntl(sudo_debug_fd, F_SETFD, FD_CLOEXEC);
        sudo_debug_mode = SUDO_DEBUG_MODE_FILE;
     } else {