initgroups() usage

utils.c

@@ -574,9 +574,38 @@ void uwsgi_as_root() {
 				uwsgi_error("setgid()");
 				exit(1);
 			}
-			if (setgroups(0, NULL)) {
-				uwsgi_error("setgroups()");
-				exit(1);
+			if (uwsgi.no_initgroups || !uwsgi.uid) {
+				if (setgroups(0, NULL)) {
+					uwsgi_error("setgroups()");
+					exit(1);
+				}
+			}
+			else {
+				char *uidname = uwsgi.uidname;
+				if (!uidname) {
+					struct passwd *pw = getpwuid(uwsgi.uid);
+					uidname = pw->pw_name;
+				}
+				if (!uidname) uidname = uwsgi_num2str(uwsgi.uid);
+				if (initgroups(uidname, uwsgi.gid)) {
+					uwsgi_error("setgroups()");
+					exit(1);
+				}
+			}
+			int additional_groups = getgroups(0, NULL);
+			gid_t *gids = uwsgi_calloc(sizeof(gid_t) * additional_groups);
+			int i;
+			if (getgroups(additional_groups, gids) > 0) {
+				for(i=0;i<additional_groups;i++) {
+					if (gids[i] == uwsgi.gid) continue;
+					struct group *gr = getgrgid(gids[i]);
+					if (gr) {	
+						uwsgi_log("set additional group %d (%s)\n", gids[i], gr->gr_name);
+					}
+					else {
+						uwsgi_log("set additional group %d\n", gids[i]);
+					}
+				}
 			}
 		}
 		if (uwsgi.uid) {

uwsgi.c

@@ -182,6 +182,7 @@ static struct uwsgi_option uwsgi_base_options[] = {
 	{"chroot", required_argument, 0, "chroot() to the specified directory", uwsgi_opt_set_str, &uwsgi.chroot,0},
 	{"uid", required_argument, 0, "setuid to the specified user/uid", uwsgi_opt_set_uid, NULL, 0},
 	{"gid", required_argument, 0, "setgid to the specified group/gid", uwsgi_opt_set_gid, NULL, 0},
+	{"no-initgroups", no_argument, 0, "disable additional groups set via initgroups()", uwsgi_opt_true, &uwsgi.no_initgroups, 0},
 #ifdef UWSGI_CAP
 	{"cap", required_argument,0, "set process capability", uwsgi_opt_set_cap, NULL, 0},
 #endif

uwsgi.h

@@ -1168,6 +1168,7 @@ struct uwsgi_server {
 	uid_t uid;
 	char *uidname;
 	char *gidname;
+	int no_initgroups;
 
 #ifdef UWSGI_CAP
 	cap_value_t *cap;