=== modified file 'TODO'
--- TODO	2008-08-03 01:09:36 +0000
+++ TODO	2008-08-03 20:35:01 +0000
@@ -5,16 +5,12 @@
 ** header files/symbols tally
 ** check exit codes of all system calls
 ** IPv4 support
-** protocol version header
 ** use strsep instead of strtok?
-** change uid to nobody:nogroup
-   other drop privs stuff?
 
 * Pluginbasedclient
 ** header files/symbols tally
 ** check exit codes of all system calls
 ** [#C] pass things in environment, like device name, etc
-   Does cryptsetup already do this?
 ** use strsep instead of strtok?
 ** use config file in addition to arguments
 

=== modified file 'plugins.d/mandosclient.c'
--- plugins.d/mandosclient.c	2008-08-03 17:24:47 +0000
+++ plugins.d/mandosclient.c	2008-08-03 20:35:01 +0000
@@ -89,6 +89,7 @@
   AvahiServer *server;
   gnutls_certificate_credentials_t cred;
   unsigned int dh_bits;
+  gnutls_dh_params_t dh_params;
   const char *priority;
 } mandos_context;
 
@@ -286,8 +287,7 @@
   fprintf(stderr, "GnuTLS: %s", string);
 }
 
-static int initgnutls(mandos_context *mc, gnutls_session_t *session,
-		      gnutls_dh_params_t *dh_params){
+static int init_gnutls_global(mandos_context *mc){
   int ret;
   
   if(debug){
@@ -335,21 +335,26 @@
   }
   
   /* GnuTLS server initialization */
-  ret = gnutls_dh_params_init(dh_params);
+  ret = gnutls_dh_params_init(&mc->dh_params);
   if (ret != GNUTLS_E_SUCCESS) {
     fprintf (stderr, "Error in GnuTLS DH parameter initialization:"
 	     " %s\n", safer_gnutls_strerror(ret));
     return -1;
   }
-  ret = gnutls_dh_params_generate2(*dh_params, mc->dh_bits);
+  ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
   if (ret != GNUTLS_E_SUCCESS) {
     fprintf (stderr, "Error in GnuTLS prime generation: %s\n",
 	     safer_gnutls_strerror(ret));
     return -1;
   }
   
-  gnutls_certificate_set_dh_params(mc->cred, *dh_params);
-  
+  gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
+
+  return 0;
+}
+
+static int init_gnutls_session(mandos_context *mc, gnutls_session_t *session){
+  int ret;
   /* GnuTLS session creation */
   ret = gnutls_init(session, GNUTLS_SERVER);
   if (ret != GNUTLS_E_SUCCESS){
@@ -406,7 +411,7 @@
   gnutls_session_t session;
   gnutls_dh_params_t dh_params;
   
-  ret = initgnutls (mc, &session, &dh_params);
+  ret = init_gnutls_session (mc, &session);
   if (ret != 0){
     return -1;
   }
@@ -722,6 +727,8 @@
     const char *interface = "eth0";
     struct ifreq network;
     int sd;
+    uid_t uid;
+    gid_t gid;
     char *connect_to = NULL;
     AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
     mandos_context mc = { .simple_poll = NULL, .server = NULL,
@@ -802,6 +809,25 @@
       perror("combinepath");
       goto end;
     }
+
+    ret = init_gnutls_global(&mc);
+    if (ret == -1){
+      fprintf(stderr, "init_gnutls_global\n");
+      goto end;
+    }
+
+    uid = getuid();
+    gid = getgid();
+
+    ret = setuid(uid);
+    if (ret == -1){
+      perror("setuid");
+    }
+    
+    setgid(gid);
+    if (ret == -1){
+      perror("setgid");
+    }
     
     if_index = (AvahiIfIndex) if_nametoindex(interface);
     if(if_index == 0){
@@ -815,22 +841,25 @@
       char *address = strrchr(connect_to, ':');
       if(address == NULL){
         fprintf(stderr, "No colon in address\n");
-	exit(EXIT_FAILURE);
+	exitcode = EXIT_FAILURE;
+	goto end;
       }
       errno = 0;
       uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
       if(errno){
 	perror("Bad port number");
-	exit(EXIT_FAILURE);
+	exitcode = EXIT_FAILURE;
+	goto end;
       }
       *address = '\0';
       address = connect_to;
       ret = start_mandos_communication(address, port, if_index, &mc);
       if(ret < 0){
-	exit(EXIT_FAILURE);
+	exitcode = EXIT_FAILURE;
       } else {
-	exit(EXIT_SUCCESS);
+	exitcode = EXIT_SUCCESS;
       }
+      goto end;
     }
     
     /* If the interface is down, bring it up */

=== modified file 'server.py'
--- server.py	2008-08-03 17:24:47 +0000
+++ server.py	2008-08-03 20:35:01 +0000
@@ -602,28 +602,20 @@
                         unicode(error))
         raise AvahiGroupError("State changed: %s", str(error))
 
-def if_nametoindex(interface, _func=[None]):
+def if_nametoindex(interface):
     """Call the C function if_nametoindex(), or equivalent"""
-    if _func[0] is not None:
-        return _func[0](interface)
+    global if_nametoindex
     try:
         if "ctypes.util" not in sys.modules:
             import ctypes.util
-        while True:
-            try:
-                libc = ctypes.cdll.LoadLibrary\
-                       (ctypes.util.find_library("c"))
-                _func[0] = libc.if_nametoindex
-                return _func[0](interface)
-            except IOError, e:
-                if e != errno.EINTR:
-                    raise
+        if_nametoindex = ctypes.cdll.LoadLibrary\
+            (ctypes.util.find_library("c")).if_nametoindex
     except (OSError, AttributeError):
         if "struct" not in sys.modules:
             import struct
         if "fcntl" not in sys.modules:
             import fcntl
-        def the_hard_way(interface):
+        def if_nametoindex(interface):
             "Get an interface index the hard way, i.e. using fcntl()"
             SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
             s = socket.socket()
@@ -632,8 +624,7 @@
             s.close()
             interface_index = struct.unpack("I", ifreq[16:20])[0]
             return interface_index
-        _func[0] = the_hard_way
-        return _func[0](interface)
+    return if_nametoindex(interface)
 
 
 def daemon(nochdir, noclose):