Lighttpd

Currently, server.username sets only the user and server.groupname sets only the group.

This means that if lighttpd is started as root, both server.username and server.groupname must be specified in order for lighttpd to drop privileges.

It also means that there is no facility to set a group list.

I propose updating the server.username and server.groupname logic as follows:

if server.groupname is set {
    setgroups( to specified group )
    setgid( to specified group )
  }
  elseif server.username is set {
    setgroups( to group list for specified user )
    setgid( to group for specified user )
  }
  if server.username is set {
    setuid( to specified user )
  }

I am willing to write a patch if the logic is agreeable.

-- daniel.kauffman