>From b8b4c488e256d12ab769bad4c552908647a53a5e Mon Sep 17 00:00:00 2001
From: Nils Goroll <nils.goroll@uplex.de>
Date: Thu, 2 Aug 2012 20:02:58 +0200
Subject: [PATCH] give away the tmpdir to the privilege seperation user

---
 bin/varnishd/mgt/mgt_main.c |   10 ++++++++++
 1 files changed, 10 insertions(+), 0 deletions(-)

diff --git a/bin/varnishd/mgt/mgt_main.c b/bin/varnishd/mgt/mgt_main.c
index 7b42437..38aaf0c 100644
--- a/bin/varnishd/mgt/mgt_main.c
+++ b/bin/varnishd/mgt/mgt_main.c
@@ -45,6 +45,7 @@
 
 #include "mgt/mgt.h"
 #include "common/heritage.h"
+#include "common/params.h"
 
 #include "hash/hash_slinger.h"
 #include "vav.h"
@@ -577,6 +578,15 @@ main(int argc, char * const *argv)
 		    dirname, strerror(errno));
 		exit(1);
 	}
+	/*
+	 * XXX compiling with privilege seperation requires that the working dir
+	 *     be writable by the user we setuid to, but with least privileges
+	 *     in effect, the following checks could fail if the user varnish
+	 *     is started with can run setuid, but does now have super cow powers
+	 *     on files (solaris: file_dac_write)
+	 *
+	 */
+	(void)chown(dirname, mgt_param.uid, mgt_param.gid);
 
 	if (chdir(dirname) < 0) {
 		fprintf(stderr, "Cannot change to working directory '%s': %s\n",
-- 
1.5.6.5

