[Dnsmasq-discuss] [PATCH] don't setgroup to root

[Leon M. Busch-George]

From: "Leon M. Busch-George" <leon at georgemail.eu>

Without this patch, dnsmasq wont start in namespaces without group ID
mappings unless setgroups is explicitly allowed (e.g. write "allow" to
/proc/self/setgroups).
This happens even if the target gid matches the current one.

Work around this issue by not calling setgroups when the target gid is 0,
which matches the guard around calling setuid (ent_pw->pw_uid != 0).
---
 src/dnsmasq.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/dnsmasq.c b/src/dnsmasq.c
index 8fcbbda..2a3ff33 100644
--- a/src/dnsmasq.c
+++ b/src/dnsmasq.c
@@ -742,7 +742,7 @@ int main (int argc, char **argv)
       gid_t dummy;
       
       /* remove all supplementary groups */
-      if (gp && 
+      if (gp && gp->gr_gid != 0 &&
 	  (setgroups(0, &dummy) == -1 ||
 	   setgid(gp->gr_gid) == -1))
 	{
-- 
2.55.0