0002-zebra-raise-the-privileges-before-calling-socket.patch

--- a/zebra/rt_netlink.c	2016-10-17 13:08:33.831542376 +1000
+++ b/zebra/rt_netlink.c	2016-10-17 13:23:38.726277154 +1000
@@ -154,6 +154,20 @@
   int namelen;
   int save_errno;
 
+  /* Bind the socket to the netlink structure for anything. */
+  ret = bind (sock, (struct sockaddr *) &snl, sizeof snl);
+  save_errno = errno;
+  if (zserv_privs.change (ZPRIVS_LOWER))
+    zlog (NULL, LOG_ERR, "Can't lower privileges");
+
+  if (ret < 0)
+    {
+      zlog (NULL, LOG_ERR, "Can't bind %s socket to group 0x%x: %s",
+            nl->name, snl.nl_groups, safe_strerror (save_errno));
+      close (sock);
+      return -1;
+    }
+
   if (zserv_privs.change (ZPRIVS_RAISE))
     {
       zlog (NULL, LOG_ERR, "Can't raise privileges");
@@ -172,20 +186,6 @@
   snl.nl_family = AF_NETLINK;
   snl.nl_groups = groups;
 
-  /* Bind the socket to the netlink structure for anything. */
-  ret = bind (sock, (struct sockaddr *) &snl, sizeof snl);
-  save_errno = errno;
-  if (zserv_privs.change (ZPRIVS_LOWER))
-    zlog (NULL, LOG_ERR, "Can't lower privileges");
-
-  if (ret < 0)
-    {
-      zlog (NULL, LOG_ERR, "Can't bind %s socket to group 0x%x: %s",
-            nl->name, snl.nl_groups, safe_strerror (save_errno));
-      close (sock);
-      return -1;
-    }
-
   /* multiple netlink sockets will have different nl_pid */
   namelen = sizeof snl;
   ret = getsockname (sock, (struct sockaddr *) &snl, (socklen_t *) &namelen);