svn commit: r1899896 - /spamassassin/trunk/spamd/spamd.raw

[he...@apache.org]

Author: hege
Date: Sat Apr 16 05:11:33 2022
New Revision: 1899896

URL: http://svn.apache.org/viewvc?rev=1899896&view=rev
Log:
Don't try to change uid/gid if not needed

Modified:
    spamassassin/trunk/spamd/spamd.raw

Modified: spamassassin/trunk/spamd/spamd.raw
URL: http://svn.apache.org/viewvc/spamassassin/trunk/spamd/spamd.raw?rev=1899896&r1=1899895&r2=1899896&view=diff
==============================================================================
--- spamassassin/trunk/spamd/spamd.raw (original)
+++ spamassassin/trunk/spamd/spamd.raw Sat Apr 16 05:11:33 2022
@@ -1401,31 +1401,39 @@ sub spawn {
       # bug 3900: assignments to $> and $< problems with BSD perl bug
       # use the POSIX functions to hide the platform specific workarounds 
       dbg("spamd: Privilege de-escalation from user $< and groups $(\n");
-      $! = 0; POSIX::setgid($ugid);  # set effective and real gid
-      if ($!) { warn("spamd: POSIX::setgid $ugid failed: $!\n"); }
-      $! = 0; $( = $ugid;
-      if ($!) { warn("spamd: failed to set gid $ugid: $!\n"); }
-      # set effective and real gid/grouplist another way because we lack initgroups in Perl
       my $togids = "$ugid ".get_user_groups($uuid);
-      $! = 0; $) = $togids;
-      if ($!) {
-        # could be perl 5.30 bug #134169, let's be safe
-        if (grep { $_ eq '0' } split(/ /, ${)})) {
-          die("spamd: failed to set effective gid $togids: $!\n");
-        } else {
-          warn("spamd: failed to set effective gid $togids: $!\n");
+      if ($( ne $togids || $) ne $togids) {
+        $! = 0; POSIX::setgid($ugid);  # set effective and real gid
+        if ($!) { warn("spamd: POSIX::setgid $ugid failed: $!\n"); }
+        $! = 0; $( = $ugid;
+        if ($!) { warn("spamd: failed to set gid $ugid: $!\n"); }
+        # set effective and real gid/grouplist another way because we lack initgroups in Perl
+        $! = 0; $) = $togids;
+        if ($!) {
+          # could be perl 5.30 bug #134169, let's be safe
+          if (grep { $_ eq '0' } split(/ /, ${)})) {
+            die("spamd: failed to set effective gid $togids: $!\n");
+          } else {
+            warn("spamd: failed to set effective gid $togids: $!\n");
+          }
         }
+      } else {
+        dbg("spamd: Group already set to $(");
       }
-      $! = 0; POSIX::setuid($uuid);  # set effective and real UID
-      if ($!) { warn("spamd: POSIX::setuid $uuid failed: $!\n"); }
-      $! = 0; $< = $uuid; $> = $uuid;   # bug 5574
-      if ($!) { warn("spamd: setuid $uuid failed: $!\n"); }
-      dbg("spamd: now running as: ruid=$< euid=$> rgid=$( egid=$)");
+      if ($< != $uuid || $> != $uuid) {
+        $! = 0; POSIX::setuid($uuid);  # set effective and real UID
+        if ($!) { warn("spamd: POSIX::setuid $uuid failed: $!\n"); }
+        $! = 0; $< = $uuid; $> = $uuid;   # bug 5574
+        if ($!) { warn("spamd: setuid $uuid failed: $!\n"); }
+        dbg("spamd: now running as: ruid=$< euid=$> rgid=$( egid=$)");
 
-      # keep the sanity check to catch problems like bug 3900 just in case
-      if ( $> != $uuid and $> != ( $uuid - 2**32 ) ) {
-        sleep(1); # prevent spamd fork flooding
-        die "spamd: setuid to uid $uuid failed (ruid=$<, euid=$>), not started as root?\n";
+        # keep the sanity check to catch problems like bug 3900 just in case
+        if ( $> != $uuid and $> != ( $uuid - 2**32 ) ) {
+          sleep(1); # prevent spamd fork flooding
+          die "spamd: setuid to uid $uuid failed (ruid=$<, euid=$>), not started as root?\n";
+        }
+      } else {
+        dbg("spamd: Uid already set to $<");
       }
     }