ask/celery — Issue #579: Privileges not completely dropped
Author: jl6
Created: 2011-12-28 11:21:43+00:00
State: open

It appears that celery does not use os.setgroups() when dropping privileges (just had a look in platforms.py). This means that I can't run celeryd as user X (a member of group Y) and have it read file Z (mode 0750, group Y). It may also mean the celeryd process inherits the root group, which may be dangerous.