Inherit supplementary groups if no group has been specified

man/sniproxy.conf.5

@@ -28,6 +28,21 @@ username daemon
 Specify the user sniproxy will run as. When sniproxy is launched as super user,
 it will drop permissions to this user.
 
+.SS GROUPNAME
+
+.PP
+.nf
+groupname daemon
+.fi
+.PP
+
+Overrides the group sniproxy will run as. When sniproxy is launched as super
+user, it will change its primary group to this, and drop all supplementary
+groups.
+
+If this parameter is not specified, the primary group and supplementary groups
+will be taken from the user sniproxy is running as.
+
 .SS PIDFILE
 
 .PP

src/sniproxy.c

@@ -233,11 +233,29 @@ drop_perms(const char *username, const char *groupname) {
         fatal("getgrnam(): group %s does not exist", groupname);
 
       gid = group->gr_gid;
-    }
 
-    /* drop any supplementary groups */
-    if (setgroups(1, &gid) < 0)
-        fatal("setgroups(): %s", strerror(errno));
+      /* drop any supplementary groups */
+      if (setgroups(1, &gid) < 0)
+          fatal("setgroups(): %s", strerror(errno));
+    } else {
+        /* if no group has been specified, load user's supplementary groups */
+        int ngroups = 0;
+        if (getgrouplist(user->pw_name, user->pw_gid, NULL, &ngroups) != -1)
+            fatal("getgrouplist(): %s", strerror(errno));
+
+        gid_t *groups = malloc(ngroups * sizeof(gid_t));
+        if (groups == NULL)
+            fatal("malloc(): %s", strerror(errno));
+
+        ngroups = getgrouplist(user->pw_name, user->pw_gid, groups, &ngroups);
+        if (ngroups < 0)
+            fatal("getgrouplist(): %s", strerror(errno));
+
+        if (setgroups(ngroups, groups) < 0)
+            fatal("setgroups(): %s", strerror(errno));
+
+        free(groups);
+    }
 
     /* set the main gid */
     if (setgid(gid) < 0)