Deal correctly with being SGID

diff --git a/games/rogue/init.c b/games/rogue/init.c
index 339a495..60b7b24 100644 (file)
--- a/games/rogue/init.c
+++ b/games/rogue/init.c
@@ -57,6 +57,7 @@ static char rcsid[] = "$NetBSD: init.c,v 1.4 1995/04/28 23:49:19 mycroft Exp $";
  */
 
 #include <stdio.h>
+#include <unistd.h>
 #include "rogue.h"
 
 char login_name[MAX_OPT_LEN];
@@ -72,6 +73,7 @@ boolean no_skull = 0;
 boolean passgo = 0;
 char *error_file = "rogue.esave";
 char *byebye_string = "Okay, bye bye!";
+gid_t gid, egid;
 
 extern char *fruit;
 extern char *save_file;
@@ -85,6 +87,9 @@ char *argv[];
        char *pn;
        int seed;
 
+       gid = getgid();
+       egid = getegid();
+       setegid(gid);
        pn = md_gln();
        if ((!pn) || (strlen(pn) >= MAX_OPT_LEN)) {
                clean_up("Hey!  Who are you?");

diff --git a/games/rogue/machdep.c b/games/rogue/machdep.c
index 1862d40..b969f58 100644 (file)
--- a/games/rogue/machdep.c
+++ b/games/rogue/machdep.c
@@ -454,14 +454,18 @@ int status;
 md_lock(l)
 boolean l;
 {
+       extern gid_t gid, egid;
        static int fd;
        short tries;
 
        if (l) {
+               setegid(egid);
                if ((fd = open(_PATH_SCOREFILE, O_RDONLY)) < 1) {
+                       setegid(gid);
                        message("cannot lock score file", 0);
                        return;
                }
+               setegid(gid);
                for (tries = 0; tries < 5; tries++)
                        if (!flock(fd, LOCK_EX|LOCK_NB))
                                return;

diff --git a/games/rogue/score.c b/games/rogue/score.c
index 814c1d3..98635ab 100644 (file)
--- a/games/rogue/score.c
+++ b/games/rogue/score.c
@@ -209,14 +209,18 @@ short other;
        FILE *fp;
        long s;
        boolean pause = score_only;
+       extern gid_t gid, egid;
 
        md_lock(1);
 
+       setegid(egid);
        if ((fp = fopen(_PATH_SCOREFILE, "r+")) == NULL &&
            (fp = fopen(_PATH_SCOREFILE, "w+")) == NULL) {
+               setegid(gid);
                message("cannot read/write/create score file", 0);
                sf_error();
        }
+       setegid(gid);
        rewind(fp);
        (void) xxx(1);