Re: chpst -u and supplementary groups

From: Bougy Man <tj_at_rubyists.com>
Date: Mon, 19 Aug 2019 17:06:58 -0500

When I need this functionality, I generally use `groups=id -G|sed -e
's/\s/:/g'` then `chpst -u myuser:$groups` for the command line. This is
almost always just for processes I want to run as my own user, so it's a
rarity.

Tj

On Mon, Aug 19, 2019 at 7:08 AM Jan Braun <janbraun_at_gmx.de> wrote:

> Hello list!
>
> Yesterday, I spent way too much time chasing down a permissions problem
> caused by the fact that "chpst -u acc prog..." only sets the account's
> primary group, and ignores any supplementary groups the account may be a
> member of.
>
> TFM mentions "All initial supplementary groups are removed.", but I
> failed to memorize that. (Also, what does "initial" signify here?)
>
> My inability to see the issue came from the fact that all other similar
> programs (I'm aware of) do in fact add the supplementary groups. Watch:
>
> | # chpst -u test id
> | uid=1003(test) gid=1003(test) groups=1003(test)
> | # runuser -u test id
> | uid=1003(test) gid=1003(test) groups=1003(test),4(adm)
> | # s6-setuidgid test id
> | uid=1003(test) gid=1003(test) groups=1003(test),4(adm)
> | # su - test -c id
> | uid=1003(test) gid=1003(test) groups=1003(test),4(adm)
> | # su test -c id
> | uid=1003(test) gid=1003(test) groups=1003(test),4(adm)
> | # sudo -u test id
> | uid=1003(test) gid=1003(test) groups=1003(test),4(adm)
> | #
>
> So now I'm wondering:
> What are the use cases for not applying existing supplementary groups?
> Should chpst apply them by default?
> Should chpst grow an option to (not) apply them?
> "chpst -u acc: prog..." is still free.
> Or is everything as it's supposed to be, and people might need to munge
> the output of "getent initgroups acc" and feed it to the -u option?
>
> I'll be happy to try to come up with a patch (even if it's still a
> fatter warning in the manpage) if people can agree here what the right
> thing to do is.
>
> regards,
> Jan
>
Received on Mon Aug 19 2019 - 22:06:58 UTC