#37823 [NEW]: posix_setgid fails to logout of groups, or call initgroups()

From: james-php at bytehosting dot com Operating system: mandriva2006.0 - linux 2.6.12-22 PHP version: 5.1.4 PHP Bug Type: POSIX related Bug description: posix_setgid fails to logout of groups, or call initgroups() Description: ------------ When calling posix_get[e]gid() to drop root privledges, it does NOT logout of group=0(root). Please look VERY closely at the 'id' output from the script, you will see that the third section "groups=" shows that i am effectively still logged into group "0". It indeed sets the current process group id to 0, however, it does NOT completely DROP all group memeberships, as well PHP provides no "posix_initgroups()" so there is no way to call initgroups() on linux to re-init the group memeberships from /etc/group, which would effectively, or should, drop the group=0(root) membership. Reproduce code: --------------- <? system("id"); posix_setgid(500); posix_setegid(500); posix_setuid(500); posix_seteuid(500); system("id"); ?> Expected result: ---------------- [root@admin cluster]# php test.php uid=0(root) gid=0(root) groups=0(root) uid=500(cluster) gid=500(cluster) groups=500(cluster) [root@admin cluster]# Actual result: -------------- [root@admin cluster]# php test.php uid=0(root) gid=0(root) groups=0(root) uid=500(cluster) gid=500(cluster) groups=0(root) [root@admin cluster]# -- Edit bug report at http://bugs.php.net/?id=37823&edit=1 -- Try a CVS snapshot (PHP 4.4): http://bugs.php.net/fix.php?id=37823&r=trysnapshot44 Try a CVS snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=37823&r=trysnapshot52 Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=37823&r=trysnapshot60 Fixed in CVS: http://bugs.php.net/fix.php?id=37823&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=37823&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=37823&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=37823&r=needscript Try newer version: http://bugs.php.net/fix.php?id=37823&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=37823&r=support Expected behavior: http://bugs.php.net/fix.php?id=37823&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=37823&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=37823&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=37823&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=37823&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=37823&r=dst IIS Stability: http://bugs.php.net/fix.php?id=37823&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=37823&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=37823&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=37823&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=37823&r=mysqlcfg