CVE-2009-3564: Medium severity puppet vulnerability

Description of problem: I noticed that puppetmasterd does not initialize its supplementary groups, which may lead to allow puppetmasterd to access files, it should not. E.g. if it is started with "service puppetmaster start", it still has access to all files that allow read access for the supplementary groups of root, e.g. raw disk devices.

I filed an upstream bug report including patches (one needs still to be tested) here: http://projects.reductivelabs.com/issues/show/1806

Version-Release number of selected component (if applicable): puppet-0.24.6-1.fc10 puupet-0.24.6-1.el5

How reproducible: always

Steps to Reproduce: 1. # service puppetmaster start 2. # cat /proc/$(ps --User puppet -o pid | tail -n 1)/status | grep Group Actual results: The output matches "id -G root".

Expected results: The output should match "id -G puppet", i.e. the process should run with the supplementary groups of puppet.

The default supplementary groups of root include the group disk, which e.g. provides raw read access on disk devices.

Additional info: I am not sure, whether this really classifies as a security vulnerability, because https://fedoraproject.org/wiki/Security/Classifications only mentions code execution and denial of service, but imho unwanted access to restricted information is a security vulnerability, too.