cmd/hsu: check against setgid bit

The getgroups behaviour is already checked for, but it never hurts to be more careful in a setuid program.

Signed-off-by: Ophestra <cat@gensokyo.uk>

1 files changed, 3 insertions, 0 deletions

diff --git a/cmd/hsu/main.go b/cmd/hsu/main.go
index 1f6ca7b6..27b97b5c 100644
--- a/cmd/hsu/main.go
+++ b/cmd/hsu/main.go
@@ -34,6 +34,9 @@ func main() {
 	if os.Geteuid() != 0 {
 		log.Fatal("this program must be owned by uid 0 and have the setuid bit set")
 	}
+	if os.Getegid() != os.Getgid() {
+		log.Fatal("this program must not have the setgid bit set")
+	}
 
 	puid := os.Getuid()
 	if puid == 0 {