mxqd: don't attempt privileged operations when running as non-root

mariux · Oct 16, 2015 · 71a8239 · 71a8239
1 parent 977f7fb
commit 71a8239
Showing 1 changed file with 22 additions and 19 deletions.
diff --git a/mxqd.c b/mxqd.c
@@ -875,27 +875,30 @@ static int init_child_process(struct mxq_group_list *group, struct mxq_job *j)
                             g->user_name, g->user_uid, g->group_id, j->job_id);
     }
 
-    res = initgroups(passwd->pw_name, g->user_gid);
-    if (res == -1) {
-        mx_log_err("job=%s(%d):%lu:%lu initgroups() failed: %m",
-            g->user_name, g->user_uid, g->group_id, j->job_id);
-        return 0;
-    }
+    if(getuid()==0) {
 
-    res = setregid(g->user_gid, g->user_gid);
-    if (res == -1) {
-        mx_log_err("job=%s(%d):%lu:%lu setregid(%d, %d) failed: %m",
-            g->user_name, g->user_uid, g->group_id, j->job_id,
-            g->user_gid, g->user_gid);
-        return 0;
-    }
+        res = initgroups(passwd->pw_name, g->user_gid);
+        if (res == -1) {
+            mx_log_err("job=%s(%d):%lu:%lu initgroups() failed: %m",
+                g->user_name, g->user_uid, g->group_id, j->job_id);
+            return 0;
+        }
 
-    res = setreuid(g->user_uid, g->user_uid);
-    if (res == -1) {
-        mx_log_err("job=%s(%d):%lu:%lu setreuid(%d, %d) failed: %m",
-            g->user_name, g->user_uid, g->group_id, j->job_id,
-            g->user_uid, g->user_uid);
-        return 0;
+        res = setregid(g->user_gid, g->user_gid);
+        if (res == -1) {
+            mx_log_err("job=%s(%d):%lu:%lu setregid(%d, %d) failed: %m",
+                g->user_name, g->user_uid, g->group_id, j->job_id,
+                g->user_gid, g->user_gid);
+            return 0;
+        }
+
+        res = setreuid(g->user_uid, g->user_uid);
+        if (res == -1) {
+            mx_log_err("job=%s(%d):%lu:%lu setreuid(%d, %d) failed: %m",
+                g->user_name, g->user_uid, g->group_id, j->job_id,
+                g->user_uid, g->user_uid);
+            return 0;
+        }
     }
 
     res = chdir(j->job_workdir);