commit 191fe44c972e7f45f4bac1cee27522ae244da498
author Nick Kralevich <nnk@google.com> Fri Mar 29 16:24:05 2013 +0000
committer Gerrit Code Review <noreply-gerritcodereview@google.com> Fri Mar 29 16:24:06 2013 +0000
tree 1e2deefbdcbd1ba18dae0d14f6a3270c4e4cda04
parent c8df252fa16d328be197ecc5280a2f8c2aacb5ad
parent b0f1540f2a1959120d1b083fa14d65f5c45335f8

Merge "run-as: Don't require CAP_DAC_READ_SEARCH"

run-as/package.c

diff --git a/run-as/package.c b/run-as/package.c
index dce132e..27fc1eb 100644
--- a/run-as/package.c
+++ b/run-as/package.c
@@ -80,13 +80,30 @@
     struct stat  st;
     size_t  length = 0;
     void*   address = NULL;
+    gid_t   oldegid;
 
     *filesize = 0;
 
+    /*
+     * Temporarily switch effective GID to allow us to read
+     * the packages file
+     */
+
+    oldegid = getegid();
+    if (setegid(AID_SYSTEM) < 0) {
+        return NULL;
+    }
+
     /* open the file for reading */
     fd = TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
-    if (fd < 0)
+    if (fd < 0) {
         return NULL;
+    }
+
+    /* restore back to our old egid */
+    if (setegid(oldegid) < 0) {
+        goto EXIT;
+    }
 
     /* get its size */
     ret = TEMP_FAILURE_RETRY(fstat(fd, &st));