Call initgroups before setuid to inherit additional group rights

fixes #6809

Signed-off-by: Gunnar Beutner <gunnar.beutner@netways.de>

diff --git a/icinga-app/icinga.cpp b/icinga-app/icinga.cpp
index 29f2d8913cecdb17422a8b133bb313c52f416f52..866e4606ca9b1a5191e06fc4f350be109436e746 100644 (file)
--- a/icinga-app/icinga.cpp
+++ b/icinga-app/icinga.cpp
@@ -440,6 +440,14 @@ int Main(void)
                        }
                }
 
+               // also activate the additional groups the configured user is member of
+               if (!g_AppParams.count("reload-internal") && initgroups(user.CStr(), pw->pw_gid) < 0) {
+                       std::ostringstream msgbuf;
+                       msgbuf << "initgroups() failed with error code " << errno << ", \"" << Utility::FormatErrorNumber(errno) << "\"";
+                       Log(LogCritical, "icinga-app",  msgbuf.str());
+                       return EXIT_FAILURE;
+               }
+
                if (setuid(pw->pw_uid) < 0) {
                        std::ostringstream msgbuf;
                        msgbuf << "setuid() failed with error code " << errno << ", \"" << Utility::FormatErrorNumber(errno) << "\"";