Not sure this is the correct solution.
How are you configuring dnsmasq? If there's no --group option, then it
will try and set the group of the daemon process to "dip", which is
archaic, but quite likely still useful somewhere, so I don't want to
change it.
Are you overriding the change to "dip" by setting --group=root and that
what's causing the error? Again, there may be installations where that's
in use and required, which I don't want to break.
Could the solution to this be --group (with no arg) or a new --nogroup
option which explicitly disables the setgid() call?
Simon.
On 27.07.2026 13:51, Leon M. Busch-George wrote:
From: "Leon M. Busch-George" <[email protected]>
Without this patch, dnsmasq wont start in namespaces without group ID
mappings unless setgroups is explicitly allowed (e.g. write "allow" to
/proc/self/setgroups).
This happens even if the target gid matches the current one.
Work around this issue by not calling setgroups when the target gid is 0,
which matches the guard around calling setuid (ent_pw->pw_uid != 0).
---
src/dnsmasq.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/dnsmasq.c b/src/dnsmasq.c
index 8fcbbda..2a3ff33 100644
--- a/src/dnsmasq.c
+++ b/src/dnsmasq.c
@@ -742,7 +742,7 @@ int main (int argc, char **argv)
gid_t dummy;
/* remove all supplementary groups */
- if (gp &&
+ if (gp && gp->gr_gid != 0 &&
(setgroups(0, &dummy) == -1 ||
setgid(gp->gr_gid) == -1))
{
_______________________________________________
Dnsmasq-discuss mailing list
[email protected]
https://lists.thekelleys.org.uk/cgi-bin/mailman/listinfo/dnsmasq-discuss
