Re: [exim] After upgrade to Exim 4.95 or 4.96: "setgroups: I…

On Thu, 22 Sep 2022, Lasse Törngren via Exim-users wrote:

> Hello Andrew,
>
> Thank you for your feedback, your commitment and the patch. When
> applying your patch, the compilation gets through without any
> error. After rebooting and trying this version of Exim 4.96 I get a
> new error though:

It should not be necessary to reboot; quitting all running exim processes
and restarting any daemons (server processes) will be sufficient.

> sh-3.2# /usr/local/exim/bin/exim -q

Ah. If exim -q is sufficient, you may not even need to to stop
existing exim processes.

> 2022-09-22 12:10:08.181 [683] RIKJJJ-0005NK-2O getdegid() != 6

              ...                ...

> To get my configuration working (with spam and malware control) both
> “_clamav” user and “Exim” user belongs to the group “mail” which has
> the group id of 6. I have also tested to create a new specific group
> for them, but that give the same error.
>
> Do you have any ideas on the new error?

Can you try the new patch (exim-4.96.forMac.patch2) ?
I am hoping this will provide a small clue.

Sorry this is baby-steps.

I can put my hands on a Mac but it is not set up for development
and I have not used one for about five years.
Plus I have family emergency, so don't know when I will be able to
more than these baby steps.

-- 
Andrew C. Aitchison                      Kendal, UK
                    andrew@???

--- src/priv.c

+++ src/priv.c
@@ -63,13 +63,18 @@
     log_write(0, LOG_PANIC_DIE, "seteuid(%d): %s", priv_euid, strerror(errno));
   if (setegid(priv_egid) != 0)
     log_write(0, LOG_PANIC_DIE, "setegid(%d): %s", priv_egid, strerror(errno));
-  if (priv_ngroups > 0 && setgroups(priv_ngroups, priv_groups) != 0)
+  if (priv_ngroups > 0
+#ifndef OS_SETGROUPS_ZERO_DROPS_ALL
+      && setgroups(0, NULL) != 0
+#endif
+      && setgroups(priv_ngroups, priv_groups) != 0)
     log_write(0, LOG_PANIC_DIE, "setgroups: %s", strerror(errno));
 
   if (geteuid() != priv_euid)
     log_write(0, LOG_PANIC_DIE, "getdeuid() != %d", priv_euid);
-  if (getegid() != priv_egid)
-    log_write(0, LOG_PANIC_DIE, "getdegid() != %d", priv_egid);
+  gid_t regid = getegid();
+  if (regid != priv_egid)
+      log_write(0, LOG_PANIC_DIE, "getdegid() %d != %d", regid, priv_egid);
   }
 
 priv_state = PRIV_RESTORED;