From c2f7d487d03dda2c2a0547103b9d9a7580ede03e Mon Sep 17 00:00:00 2001
From: "roberto@centos6" <roberto@centos6>
Date: Wed, 7 Mar 2012 04:40:16 +0100
Subject: [PATCH] initgroups() usage

---
 utils.c | 35 ++++++++++++++++++++++++++++++++---
 uwsgi.c |  1 +
 uwsgi.h |  1 +
 3 files changed, 34 insertions(+), 3 deletions(-)

diff --git a/utils.c b/utils.c
index b23dc49b..7c991680 100755
--- a/utils.c
+++ b/utils.c
@@ -574,9 +574,38 @@ void uwsgi_as_root() {
 				uwsgi_error("setgid()");
 				exit(1);
 			}
-			if (setgroups(0, NULL)) {
-				uwsgi_error("setgroups()");
-				exit(1);
+			if (uwsgi.no_initgroups || !uwsgi.uid) {
+				if (setgroups(0, NULL)) {
+					uwsgi_error("setgroups()");
+					exit(1);
+				}
+			}
+			else {
+				char *uidname = uwsgi.uidname;
+				if (!uidname) {
+					struct passwd *pw = getpwuid(uwsgi.uid);
+					uidname = pw->pw_name;
+				}
+				if (!uidname) uidname = uwsgi_num2str(uwsgi.uid);
+				if (initgroups(uidname, uwsgi.gid)) {
+					uwsgi_error("setgroups()");
+					exit(1);
+				}
+			}
+			int additional_groups = getgroups(0, NULL);
+			gid_t *gids = uwsgi_calloc(sizeof(gid_t) * additional_groups);
+			int i;
+			if (getgroups(additional_groups, gids) > 0) {
+				for(i=0;i<additional_groups;i++) {
+					if (gids[i] == uwsgi.gid) continue;
+					struct group *gr = getgrgid(gids[i]);
+					if (gr) {	
+						uwsgi_log("set additional group %d (%s)\n", gids[i], gr->gr_name);
+					}
+					else {
+						uwsgi_log("set additional group %d\n", gids[i]);
+					}
+				}
 			}
 		}
 		if (uwsgi.uid) {
diff --git a/uwsgi.c b/uwsgi.c
index f1df1340..35702394 100755
--- a/uwsgi.c
+++ b/uwsgi.c
@@ -182,6 +182,7 @@ static struct uwsgi_option uwsgi_base_options[] = {
 	{"chroot", required_argument, 0, "chroot() to the specified directory", uwsgi_opt_set_str, &uwsgi.chroot,0},
 	{"uid", required_argument, 0, "setuid to the specified user/uid", uwsgi_opt_set_uid, NULL, 0},
 	{"gid", required_argument, 0, "setgid to the specified group/gid", uwsgi_opt_set_gid, NULL, 0},
+	{"no-initgroups", no_argument, 0, "disable additional groups set via initgroups()", uwsgi_opt_true, &uwsgi.no_initgroups, 0},
 #ifdef UWSGI_CAP
 	{"cap", required_argument,0, "set process capability", uwsgi_opt_set_cap, NULL, 0},
 #endif
diff --git a/uwsgi.h b/uwsgi.h
index 6d61cf45..e936de05 100755
--- a/uwsgi.h
+++ b/uwsgi.h
@@ -1168,6 +1168,7 @@ struct uwsgi_server {
 	uid_t uid;
 	char *uidname;
 	char *gidname;
+	int no_initgroups;
 
 #ifdef UWSGI_CAP
 	cap_value_t *cap;