[Dnsmasq-discuss] [PATCH] don't setgroup to root

[Simon Kelley]

Not sure this is the correct solution.

How are you configuring dnsmasq? If there's no --group option, then it 
will try and set the group of the daemon process to "dip", which is 
archaic, but quite likely still useful somewhere, so I don't want to 
change it.

Are you overriding the change to "dip" by setting --group=root and that 
what's causing the error? Again, there may be installations where that's 
in use and required, which I don't want to break.

Could the solution to this be --group (with no arg) or a new --nogroup 
option which explicitly disables the setgid() call?


Simon.


On 27.07.2026 13:51, Leon M. Busch-George wrote:
> From: "Leon M. Busch-George" <leon at georgemail.eu>
> 
> Without this patch, dnsmasq wont start in namespaces without group ID
> mappings unless setgroups is explicitly allowed (e.g. write "allow" to
> /proc/self/setgroups).
> This happens even if the target gid matches the current one.
> 
> Work around this issue by not calling setgroups when the target gid is 0,
> which matches the guard around calling setuid (ent_pw->pw_uid != 0).
> ---
>   src/dnsmasq.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/src/dnsmasq.c b/src/dnsmasq.c
> index 8fcbbda..2a3ff33 100644
> --- a/src/dnsmasq.c
> +++ b/src/dnsmasq.c
> @@ -742,7 +742,7 @@ int main (int argc, char **argv)
>         gid_t dummy;
>         
>         /* remove all supplementary groups */
> -      if (gp &&
> +      if (gp && gp->gr_gid != 0 &&
>   	  (setgroups(0, &dummy) == -1 ||
>   	   setgid(gp->gr_gid) == -1))
>   	{