Your message dated Mon, 11 Jan 2016 05:26:57 +0000 with message-id <[email protected]> and subject line Bug#808289: Removed package(s) from unstable has caused the Debian Bug report #732127, regarding Does setuid also set the group(s) ? It should. to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact [email protected] immediately.) -- 732127: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=732127 Debian Bug Tracking System Contact [email protected] with problems
--- Begin Message ---Package: upstart Version: 1.20-1 The documentation in init(5) doesn't mention whether specifying setgid in the job file also results in appropriate calls to setgid and setgroups. Firstly, clearly this should be documented. But, further, I think "setuid" should cause the group ids (setresgid and also setgroups) to be set as well. Otherwise jobs will inherit the group 0 ("root") which might well be unexpectedly powerful. Arguably failure to do this is a security problem, although of course the details will depend on exactly what people write in their service files. If the user specifies setgid _and_ setuid, it's arguable whether you should also call initgroups. I would say not - not being a member of groups is generally less powerful. For comparison, I checked openbsd-inetd. If you specify just a user in an inetd.conf line, it will set the groups too. (The manpage doesn't make this entirely clear, but it seems to assume that that's what you expect because it does say that if you specify a user and a group you still get the supplementary groups for the user in question.) Ian.
--- End Message ---
--- Begin Message ---Version: 1.11-5+rm Dear submitter, as the package upstart has just been removed from the Debian archive unstable we hereby close the associated bug reports. We are sorry that we couldn't deal with your issue properly. For details on the removal, please see https://bugs.debian.org/808289 The version of this package that was in Debian prior to this removal can still be found using http://snapshot.debian.org/. This message was generated automatically; if you believe that there is a problem with it please contact the archive administrators by mailing [email protected]. Debian distribution maintenance software pp. Scott Kitterman (the ftpmaster behind the curtain)
--- End Message ---
