From 1826e01b2a3ef53e048389b44cc35f9c32258a02 Mon Sep 17 00:00:00 2001
From: Dirk Engling <erdgeist@erdgeist.org>
Date: Fri, 6 Nov 2026 20:21:35 +0100
Subject: Also drop supplementary groups on startup

---
 src/opentracker.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

(limited to 'src')

diff --git a/src/opentracker.c b/src/opentracker.c
index 123f20a..759a6d0 100644
--- a/src/opentracker.c
+++ b/src/opentracker.c
@@ -7,6 +7,7 @@
 #include <errno.h>
 #include <limits.h>
 #include <pthread.h>
+#include <grp.h>
 #include <pwd.h>
 #include <signal.h>
 #include <stdint.h>
@@ -360,10 +361,10 @@ int drop_privileges(const char *const serveruser, const char *const serverdir) {
     /* If we can't find server user, revert to nobody's default uid */
     if (!pws) {
       fprintf(stderr, "Warning: Could not get password entry for %s. Reverting to uid -2.\n", serveruser);
-      if (setegid((gid_t)-2) || setgid((gid_t)-2) || setuid((uid_t)-2) || seteuid((uid_t)-2))
+      if (setgroups(0, NULL) || setegid((gid_t)-2) || setgid((gid_t)-2) || setuid((uid_t)-2) || seteuid((uid_t)-2))
         panic("Could not set uid to value -2");
     } else {
-      if (setegid(pws->pw_gid) || setgid(pws->pw_gid) || setuid(pws->pw_uid) || seteuid(pws->pw_uid))
+      if (setgroups(0, NULL) || setegid(pws->pw_gid) || setgid(pws->pw_gid) || setuid(pws->pw_uid) || seteuid(pws->pw_uid))
         panic("Could not set uid to specified value");
     }
 
-- 
cgit v1.3