Group Ownership problem in atrun

[Steve Lademann]

(Together with other observations and other bugs, this tends to confirm
my views that the protection mechanisms in Unix are much discussed,
argued and debated, but when it comes to the crunch, NOBODY USES THEM,
otherwise minor, easily corrected bugs like this one would have been
pulicised and sorted out AGES ago.)

'Atrun' does not set the group list up at all. It only sets the gid
indicated by the 'at' control file. The solution is to add an
'initgroups' call just after the 'setgid' call. (Because the diff file
is so small, I include it here rather than mailing those who want it)


4a5,9
>  *	Set up the group access list rather than just base group
>  *	S.D.Lademann	6-May-1986
>  */
> #include <pwd.h>
> /*
82a88
> 	struct	passwd	*pw;
103a110,123
> 
> 	/*
> 	 * First, get the password file entry using the file's uid - could
> 	 * be a security hole here, but unlikely.
> 	 */
> 
> 	pw = getpwuid(stbuf.st_uid);
> 
> 	/*
> 	 * Next, initialise the groups USING THE PASSWORD ENTRY FOR BASE GROUP!
> 	 * in case the 'at' file gid doesn't match the base gid.
> 	 */
> 
> 	initgroups(pw->pw_name, pw->pw_gid);