I'll start by saying I have not been able to contact Gerd Knorr - the supposed upstream developer.

When run as root, webfsd has a -u option, which allows the program to be run as a different user. However, the supplementary groups of the original process are not reset. This means that I can run:

sudo webfsd {opts} -u nobody {opts}

and the process will maintain all of the supplementary groups of root. This is bad.


(PS - There are a couple of other issues with webfs and its handling of supplementary groups and the setuid bit. I'd like to patch everything, but as I said, upstream is not responsive.)