Lighttpd

If lighttpd is started as root, it is a security exposure to leave the server running with root groups if server.groupname is not specified. The security exposure includes all groups the root user has active, including supplemental groups; the exposure is in addition to the exposure of gid 0.

diff --git a/src/server.c b/src/server.c
index 61d850c..8a2ad12 100644
--- a/src/server.c
+++ b/src/server.c
@@ -859,6 +859,14 @@ int main (int argc, char **argv) {

 #ifdef HAVE_PWD_H
                /* set user and group */
+               if (!buffer_string_is_empty(srv->srvconf.groupname)) {
+                       if (NULL == (grp = getgrnam(srv->srvconf.groupname->ptr))) {
+                               log_error_write(srv, __FILE__, __LINE__, "sb",
+                                       "can't find groupname", srv->srvconf.groupname);
+                               return -1;
+                       }
+               }
+
                if (!buffer_string_is_empty(srv->srvconf.username)) {
                        if (NULL == (pwd = getpwnam(srv->srvconf.username->ptr))) {
                                log_error_write(srv, __FILE__, __LINE__, "sb",
@@ -871,14 +879,15 @@ int main (int argc, char **argv) {
                                                "I will not set uid to 0\n");
                                return -1;
                        }
-               }

-               if (!buffer_string_is_empty(srv->srvconf.groupname)) {
-                       if (NULL == (grp = getgrnam(srv->srvconf.groupname->ptr))) {
-                               log_error_write(srv, __FILE__, __LINE__, "sb",
-                                       "can't find groupname", srv->srvconf.groupname);
+                       if (NULL == grp && NULL == (grp = getgrgid(pwd->pw_gid))) {
+                               log_error_write(srv, __FILE__, __LINE__, "sd",
+                                       "can't find group id", pwd->pw_gid);
                                return -1;
                        }
+               }
+
+               if (NULL != grp) {
                        if (grp->gr_gid == 0) {
                                log_error_write(srv, __FILE__, __LINE__, "s",
                                                "I will not set gid to 0\n");

Separately, if server.username is not specified, the server will continue to run as root. This behavior may be intended on embedded systems. Should this be allowed? Should a warning be issued? Should we require a config directive to continue to run as root without exiting? The above patch does not address this question.