X-Git-Url: https://git.gag.com/?a=blobdiff_plain;f=common-src%2Fpipespawn.c;h=3574acc05cca24b248195a09462bf81f7ed778f4;hb=8eb7e8e19f1373f6be7f1f7837b997748ce31d0e;hp=f24beff3ee8e5befd0a85f6471f0b3913d6e884d;hpb=e9de482962ca61612054c6e0382814b04e416129;p=debian%2Famanda

diff --git a/common-src/pipespawn.c b/common-src/pipespawn.c
index f24beff..3574acc 100644
--- a/common-src/pipespawn.c
+++ b/common-src/pipespawn.c
@@ -81,7 +81,6 @@ pipespawnv_passwd(
     int *	stderrfd,
     char **	my_argv)
 {
-    int argc;
     pid_t pid;
     int i, inpipe[2], outpipe[2], errpipe[2], passwdpipe[2];
     char number[NUM_STR_SIZE];
@@ -101,17 +100,14 @@ pipespawnv_passwd(
 	passwdvar = *my_argv++;
 	passwdfd  = (int *)*my_argv++;
     }
-    g_debug("pipespawnv: stdoutfd is %d", *stdoutfd);
     memset(inpipe, -1, SIZEOF(inpipe));
     memset(outpipe, -1, SIZEOF(outpipe));
     memset(errpipe, -1, SIZEOF(errpipe));
     memset(passwdpipe, -1, SIZEOF(passwdpipe));
-    argc = 0;
 
     cmdline = stralloc(prog);
     for(arg = my_argv; *arg != NULL; arg++) {
 	if (*arg != skip_argument) {
-	    argc++;
 	    quoted = quote_string(*arg);
 	    cmdline = vstrextend(&cmdline, " ", quoted, NULL);
 	    amfree(quoted);
@@ -235,8 +231,16 @@ pipespawnv_passwd(
 	    safe_fd(-1, 0);
 	}
 
-	if (need_root)
+	if (need_root) {
 	    become_root();
+	} else {
+	    /* if our real userid is zero, the child shouldn't inherit
+	     * that, so drop privs permanently */
+	    if (getuid() == 0 && !set_root_privs(-1)) {
+		error(_("could not drop root privileges"));
+	    }
+	}
+
 	execve(prog, my_argv, env);
 	e = strerror(errno);
 	error(_("error [exec %s: %s]"), prog, e);