Re: [Openvpn-devel] [PATCH 2/2] Include supplementary groups when checking management-client-group

2023-03-06 Thread Selva Nair
Hi FTR, I just noticed that the patch is missing an endgrent() call: On Mon, Mar 6, 2023 at 12:33 AM wrote: > > +struct group *gr = getgrent(); > +char **members = NULL; > +while (gr) > +{ > +if (gr->gr_gid == gid) > +{ > +/* found the group -- check

Re: [Openvpn-devel] [PATCH 2/2] Include supplementary groups when checking management-client-group

2023-03-06 Thread Selva Nair
Hi, On Mon, Mar 6, 2023 at 3:24 AM Gert Doering wrote: > Hi, > > On Mon, Mar 06, 2023 at 12:33:46AM -0500, selva.n...@gmail.com wrote: > > From: Selva Nair > > > > - When management-client-group is in use, allow access if any of > > the supplementary groups of the user matches the specified g

Re: [Openvpn-devel] [PATCH 2/2] Include supplementary groups when checking management-client-group

2023-03-06 Thread Gert Doering
Hi, On Mon, Mar 06, 2023 at 12:33:46AM -0500, selva.n...@gmail.com wrote: > From: Selva Nair > > - When management-client-group is in use, allow access if any of > the supplementary groups of the user matches the specified group. > > Currently only the effective gid of the peer socket is ch

[Openvpn-devel] [PATCH 2/2] Include supplementary groups when checking management-client-group

2023-03-05 Thread selva . nair
From: Selva Nair - When management-client-group is in use, allow access if any of the supplementary groups of the user matches the specified group. Currently only the effective gid of the peer socket is checked which is normally the primary group of user. As unprivileged users have no ea