commit e6ec2d6d18dadb119b93284ef2f5f5b5440d6f66
author Donald Sharp <sharpd@cumulusnetworks.com> Fri Apr 08 19:30:51 2016 -0400
committer Donald Sharp <sharpd@cumulusnetworks.com> Fri Apr 22 08:38:54 2016 -0400
tree 96202e2ff5a78834986e3dd35dce947bbca1f335
parent 190591f0fe3388c746ea48f69a439f4bd0b49834

lib: Fix priviledge modification for vty group specified

When attempting to switch runtime permissions over to
the correct group specified for the vty group, if the
user specified to run as does not have that vty group
then do warn about the issue and stop running

Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
Reported-by: Thomas Martin <tmartincpp@gmail.com>
Tested-by: NetDEF CI System <cisystem@netdef.org>

lib/privs.c

diff --git a/lib/privs.c b/lib/privs.c
index 0ca8783..e6d76b6 100644
--- a/lib/privs.c
+++ b/lib/privs.c
@@ -664,6 +664,7 @@
   struct group *grentry = NULL;
   gid_t groups[NGROUPS_MAX];
   int i, ngroups = 0;
+  int found = 0;
 
   if (!zprivs)
     {
@@ -729,8 +730,17 @@
 
           for ( i = 0; i < ngroups; i++ )
             if ( groups[i] == zprivs_state.vtygrp )
-              break;
+              {
+                found++;
+                break;
+              }
 
+          if (!found)
+            {
+	      fprintf (stderr, "privs_init: user(%s) is not part of vty group specified(%s)\n",
+		       zprivs->user, zprivs->vty_group);
+              exit (1);
+            }
           if ( i >= ngroups && ngroups < (int) ZEBRA_NUM_OF(groups) )
             {
               groups[i] = zprivs_state.vtygrp;