From 5bf28901a44e36476900b3671958c1a27cef0ba0 Mon Sep 17 00:00:00 2001 From: Ophestra Date: Wed, 8 Oct 2025 18:22:24 +0900 Subject: cmd/hsu: check against setgid bit The getgroups behaviour is already checked for, but it never hurts to be more careful in a setuid program. Signed-off-by: Ophestra --- cmd/hsu/main.go | 3 +++ 1 file changed, 3 insertions(+) (limited to 'cmd') diff --git a/cmd/hsu/main.go b/cmd/hsu/main.go index 1f6ca7b6..27b97b5c 100644 --- a/cmd/hsu/main.go +++ b/cmd/hsu/main.go @@ -34,6 +34,9 @@ func main() { if os.Geteuid() != 0 { log.Fatal("this program must be owned by uid 0 and have the setuid bit set") } + if os.Getegid() != os.Getgid() { + log.Fatal("this program must not have the setgid bit set") + } puid := os.Getuid() if puid == 0 { -- cgit v1.3.1