From 5d5be299d1f82691372ed11c3d2f48f06676c01f Mon Sep 17 00:00:00 2001 From: James Woodcock Date: Fri, 26 May 2017 17:14:02 +0100 Subject: [PATCH] multiuser: login process should call setuid() and setgid(). The login process didn't call setuid() or setgid() so all users were logged in as the super user. Signed-off-by: Augustin Cavalier Fixes #13533. --- src/bin/multiuser/login.cpp | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/bin/multiuser/login.cpp b/src/bin/multiuser/login.cpp index d4dfba5181..ff6efa5792 100644 --- a/src/bin/multiuser/login.cpp +++ b/src/bin/multiuser/login.cpp @@ -156,6 +156,12 @@ setup_environment(struct passwd* passwd, bool preserveEnvironment) if (ioctl(STDIN_FILENO, TIOCSPGRP, &pid) != 0) return errno; + if (passwd->pw_gid && setgid(passwd->pw_gid) != 0) + return errno; + + if (passwd->pw_uid && setuid(passwd->pw_uid) != 0) + return errno; + const char* home = getenv("HOME"); if (home == NULL) return B_ENTRY_NOT_FOUND;