- (djm) Clear supplemental groups at sshd start to prevent them from

   being propogated to random PAM modules. Based on patch from Redhat via
   Pekka Savola <pekkas@netcore.fi>

1 files changed, 4 insertions, 0 deletions

diff --git a/sshd.c b/sshd.c
index aa822df17..ce13dcaf0 100644
--- a/sshd.c
+++ b/sshd.c
@@ -782,6 +782,10 @@ main(int ac, char **av)
                 log_stderr = 1;
         log_init(__progname, options.log_level, options.log_facility, log_stderr);
 
+        /* Make supp. groups don't get propogated to PAM modules */
+        if (setgroups(0, NULL) < 0)
+                fatal("setgroups() failed: %.200s", strerror(errno));
+
         /*
          * If not in debugging mode, and not started from inetd, disconnect
          * from the controlling terminal, and fork.  The original process