@@ -0,0 +1,6 @@
+ o Minor bug fixes:
+ - If any directory created by Tor is marked as group readable, the
+ filesystem group is allowed to be either the default GID or the root
+ user. Allowing root to read the DataDirectory prevents the need for
+ CAP_READ_SEARCH when using systemd's CapabilityBoundingSet, or
+ dac_read_search when using SELinux.
@@ -2143,7 +2143,7 @@ check_private_dir(const char *dirname, cpd_check_t check,
return -1;
}
if ( (check & (CPD_GROUP_OK|CPD_GROUP_READ))
- && (st.st_gid != running_gid) ) {
+ && (st.st_gid != running_gid) && (st.st_gid != 0)) {
struct group *gr;
char *process_groupname = NULL;
gr = getgrgid(running_gid);